Extreme Requirements

Extreme Requirements

One of Europe’s largest energy providers meets a BalaBit solution

The CEZ Group Nuclear Power Plant’s recent challenges included monitoring an increasing number of devices, increasing productivity while reducing headcount, and protecting the confidentiality of documents about the new block of the nuclear power plant under construction—all of which called for a heavyweight solution to optimize their SIEM and authorize privileged users (administrators, third parties, VDI users) and record administrative sessions. The challenge was accepted by BalaBit’s syslog-ng Store Box log management appliance and Shell Control Box privileged user monitoring solutions.

Introducing the Customer: A Nuclear Power Plant

The CEZ Group is one of the largest energy companies in Eastern and Southern Europe. Its main business is the production, distribution and sale of electricity and heat. It employs 30,000 people, operates in 10 countries in the region, and serves approximately 9.3 million customers. In terms of its market size based on customers, CEZ Group is the 7th largest energy company in Europe. CEZ ICT Services, a subsidiary of CEZ, provides information and telecommunications services for the entire group.

High Security Standards in the Nuclear Power Plant to Prevent Leakage of Information

CEZ recently faced several challenges, including a large increase of IT devices to be monitored, pressure to increase work efficiency and reduce the number of employees at the same time. They also wished to improve the security of the document management system of a special team who would select the general contractor for building the new blocks of the nuclear power plant in Temelín. Team members work on VDI-clients to access a Share- Point application to collect, process and evaluate all documents arriving from tender candidates. CEZ management specified strict IT and legal security requirements against this system to avoid legal disputations or possible lawsuits later

Consequently, CEZ needed a heavyweight solution to meet two key expectations: advanced management of logs and audit of privileged users.

“Our main goal was to prevent leakage of information or any action which would harm our IT system,” said Pavel Hejduk, head of the ICT Security Department for CEZ ICT Services. “These incidents could have led us to choose another contractor for building the new blocks of the power plant, which represented a great security risk for us.”

Requirements of the log management part of the new project, meeting the more strict regulations were web-GUI, fast log search, easy backup/archive of logs, WORM (Write Once Read Many) log storage, encryption and time stamping of logs, and high availability (HA) support.

Requirements of the auditing part of the new project, meeting the more strict regulations, included a single tool capable of authorizing administrators and recording administrative sessions, and support of all standard remote administration protocols such as SSH, Citrix ICA and RDP.

A Solid Combination of BalaBit Technologies

Previously the plant’s IT team was using the syslog-ng Open Source Edition log management tool to optimize their SIEM solution’s performance, but the due to the new requirements they needed to look for a commercial solution. They choose BalaBit’s syslog-ng Store Box (SSB) appliance.

“With syslog-ng Store Box you get a real log management tool without the need to know Linux/Unix, unlike with other tools on the market,” Hejduk said. “SSB is a log management tool, and that’s exactly what it does. Many competitors are talking about log management, but, actually, their solutions are event management. If you have, for example, 40 types of logs, implementation of an event management solution is a painful and time-consuming exercise. In the same scenario, SSB can be implemented in a few days.”

Log Management solutions implemented by CEZ:

  • A high availability SSB cluster to collect the log messages of their production systems including 250 log source hosts.
  • An additional SSB virtual appliance that runs on the VMware ESX platform for testing and development.
  • syslog-ng Agent for Windows with TLS encryption and mutual authentication to collect logs from Windows servers.

CEZ choose BalaBit’s Shell Control Box (SCB) activity monitoring appliance, as they did not find any competitive offering for transparently auditing privileged users. SCB audits and monitors the administrative access to more than one hundred servers and external communication stations (communication stations are special thin clients with strict policies, such as controlled email for example).

“Shell Control Box brought much more than we expected. It is not only an auditing solution, but an advanced authorization and OCr search tool, as well,” Hejduk said. “With its transparent Man-In-The-Middle architecture, SCB is a unique product on the market. Support of SSH/ICA/RDP/HTTP(S) auditing and replaying, as well as OCR-based indexing and searching in a single box is amazing.”

In terms of auditing privileged users’ activities, CEZ implemented a high availability SCB cluster; an additional SCB virtual appliance was also purchased for testing purposes.

The new log management and auditing solutions serve 150 users and 50 thin clients simultaneously, monitor eight IT and security administrators, and protect 100 servers in 3 environments (production, test, development). Supported by strict SLA, the production environment is “hermetically” separated from the outside world (no Internet, no phones, no papers, etc.).

Fast Implementation

Planning, testing and implementation of the whole project took two months. The new BalaBit solutions have been in productive operation since July 2012.

The SSB log server appliance was easy to deploy and configure. Archiving logs to WORM media and fast log search was a perfect combination for CEZ security experts for daily operations management and forensics investigations, as well. Indexing of logs based on B-trees* results in extremely fast searching for any parts of the VDI-client and Active Directory server logs.

SCB was a bit harder to implement, but easy to operate. CEZ benefits not just from its primary function (user authorization, audit and record sessions), but from a secondary one, as well - it provides complete documentation and replay of all configuration changes performed by implementation partners and internal administrators.

This article originally appeared in the May 2016 issue of Security Today.


  • The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    The Need for a Comprehensive Strategy Addressing Cybersecurity and Quantum Technology

    Over the past two years, the Biden Administration has taken a series of steps centered on quantum and cybersecurity. Read Now

  • IoT Saves the Day

    IoT Saves the Day

    Today, creating a safe environment across schools, hotels, office buildings, housing complexes and other facilities has become a necessity. There are so many dangers lurking in buildings of all sizes and shapes from fire hazards, vaping issues, chemical/air quality issues, intruders and so much more. Read Now

  • One Pane, Less Pain

    One Pane, Less Pain

    Just because a solution is built on an open-standards platform doesn’t ensure that all the vendors’ systems will work together as promised. Some features may not be supported, or not supported to their fullest potential. Read Now

  • Revamping Wrigley Field

    Revamping Wrigley Field

    When talking about baseball in the United States, it’s hard not to think of the Chicago Cubs and Wrigley Field. With a history spanning more than 100 years, the Chicago Cubs are one of the most recognized teams in professional sports. Read Now

Featured Cybersecurity


New Products

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3

  • Kangaroo Home Security System

    Kangaroo Home Security System

    Kangaroo is the affordable, easy-to-install home security system designed for anyone who wants an added layer of peace of mind and protection. It has several products, ranging from the fan-favorite Doorbell Camera + Chime, to the more comprehensive Front Door Security Kit with Professional Monitoring. Regardless of the level of desired security, Kangaroo’s designed to move with consumers - wherever that next chapter may be. Motion sensors, keypads and additional features can be part of the package to any Kangaroo system in place, anytime. Additionally, Kangaroo offers scalable protection plans with a variety of benefits ranging from 24/7 professional monitoring to expanded cloud storage, coverage for damage and theft. 3

  • FlexPower® Global™ Series (FPG) from LifeSafety Power

    FlexPower® Global™ Series (FPG) from LifeSafety Power

    The FlexPower® Global™ Series (FPG) from LifeSafety Power—designed to provide DC power for access control systems in international applications—is now PSE listed for Japan and compatible with the country’s 100VAC applications. 3