Team MITRE Sentinel Final Presentation Mark Nowicki Michael Dunn Kate Brown Dave Tittle Kate 12/8/2008 Purdue University - CS 307
Overview Motivation Product Features Design Results Challenges Future Work Plan for Demo Kate 12/8/2008 Purdue University - CS 307
Motivation MITRE produces XML files that contain workstation configuration information However, XML file checking is: Tedious Time consuming Prone to human error Automation will speed the process and decrease error Kate 12/8/2008 Purdue University - CS 307
Product Features Core functionality: Overall: Retains, compares, and parses XML files Baseline management (Previous configurations) Alerts administration of crucial differences Overall: Reduces time needed to monitor a network Mark 12/8/2008 Purdue University - CS 307
Design Solution: Python and MySQL implementation Open Source Solution Mark 12/8/2008 Purdue University - CS 307
Design, cont. Mark 12/8/2008 Purdue University - CS 307
Design, cont. Mark 12/8/2008 Purdue University - CS 307
Design, cont. Mark 12/8/2008 Purdue University - CS 307
Experiments Inexperience: Python & MySQL Software Engineering Practices Deadlines Metrics Code Coverage (PyUnit) Mark 12/8/2008 Purdue University - CS 307
Results No Test Bed Trouble Out of the Box Performance Configurations Files Performance Testing Trouble Out of the Box Software not perfect as-is Component functionality Performance Overhead: Database and FTP Dave 12/8/2008 Purdue University - CS 307
Challenges New Language, New Environment Freedom, Horrible Freedom Lessons Learned: Setting Boundaries Overhead Time Time Management SVN for documentation Assembla.com Dave 12/8/2008 Purdue University - CS 307
Robustness Extensive error checking If one file goes bad: error message returned move to next file (continue execution) Mike 12/8/2008 Purdue University - CS 307
Future Work Requirements not met: Additional Features Scheduler System Heartbeat Email message system Not configured to specific MITRE system Logging System Additional Features Graphical User Interface Streamlined Installation Configuration Multiple Databases Mike 12/8/2008 Purdue University - CS 307
Future Work, cont. Pitfalls of Open Source Solutions: Infancy Configuration required No Out of Box functionality Mike 12/8/2008 Purdue University - CS 307
Demo Plan Show Test Environment (MySQL) Test individual parts Execute Transfer Rule Execute system Execute All Mike 12/8/2008 Purdue University - CS 307
Questions? Thank you for your time! Kate Special Thanks to Corporate Partner Dan Aiello, MITRE Thank you for your time! 12/8/2008 Purdue University - CS 307
12/8/2008 Purdue University - CS 307
Mike 12/8/2008 Purdue University - CS 307
Mike 12/8/2008 Purdue University - CS 307
Mike 12/8/2008 Purdue University - CS 307