Supervisió i gestió de logs en entorns d'explotació

El present projecte examina la utilització d'eines de gestió de logs en entorns d'explotació de sistemes informàtics. L'objectiu del projecte és doble: proporcionar una visió general dels sistemes de gestió de logs i dur a terme una avaluació de productes que realitzin aquesta gestió de logs usant un mètode.

Tietoturvainformaation ja -tapahtumien hallinta PCI DSS -standardissa

Työn keskeisimpänä tavoitteena on tutkia SIEM-järjestelmien (Security Information and Event Management) käyttömahdollisuuksia PCI DSS -standardissa (Payment Card IndustryData Security Standard) lähtökohtaisesti ratkaisutoimittajan näkökulmasta. Työ on tehty Cygate Oy:ssä. SIEM on uusi tietoturvan ratkaisualue, jonka käyttöönottoa vauhdittavat erilaiset viralliset sääntelyt kuten luottokorttiyhtiöiden asettama PCI DSS -standardi. SIEM-järjestelmien avulla organisaatiot pystyvät keräämään valmistajariippumattomasti verkon systeemikomponenteista tapahtumatietoja, joiden avulla pystytään näkemään keskitetysti, mitä verkossa on tapahtunut. SIEM:ssa käsitellään sekä historiapohjaisia että reaaliaikaisia tapahtumia ja se toimii organisaatioiden keskitettynä tietoturvaprosessia tukevana hallintatyökaluna. PCI DSS -standardi on hyvin yksityiskohtainen ja sen vaatimusten täyttäminen ei ole yksinkertaista. Vaatimuksenmukaisuutta ei saavuteta hetkessä, vaan siihen liittyvä projekti voi kestää viikoista kuukausiin. Standardin yksi haasteellisimmista asioista on keskitetty lokien hallinta. Maksukorttitietoja käsittelevien ja välittävien organisaatioiden on kerättävä kaikki audit-lokit eri järjestelmistä, jotta maksukorttitietojen käyttöä pystytään luottamuksellisesti seuraamaan. Standardin mukaan organisaatioiden tulee käyttää myös tunkeutumisen ja haavoittuvuuksien havainnointijärjestelmiä mahdollisten tietomurtojen havaitsemiseksi ja estämiseksi. SIEM-järjestelmän avulla saadaan täytettyä PCI DSS -standardin vaativimpia lokien hallintaan liittyviä vaatimuksia ja se tuo samallamonia yksityiskohtaisia parannuksia tukemaan muita standardin vaatimuskohtia. Siitä voi olla hyötyä mm. tunkeutumisen ja haavoittuvuuksien havainnoinnissa. SIEM-järjestelmän hyödyntäminen standardin apuna on kuitenkin erittäin haasteellista. Käyttöönotto vaatii tarkkaa etukäteissuunnittelua ja kokonaisuuksien ymmärtämistä niin ratkaisutoimittajan kuin ratkaisun käyttöönottajan puolelta.

Logghantering : En undersökning av logghantering och logghanteringssystem

This research includes a review of the log management of the company Telia. The research has also included a comparison of the two log management sys- tems Splunk and ELK. The review of the company’s log management shows that log messages are being stored in files on a hard drive that can be accessed through the network. The log messages are system-specific. ELK is able to fetch log messages of different formats simultaneously, but this feature is not possible in Splunk where the process of uploading log messages has to be re- peated for log messages that have different formats. Both systems store log messages through a file system on a hard drive, where the systems are installed. In networks that involve multiple servers, ELK is distributing the log messages between the servers. Thus, the workload to perform searches and storing large amounts of data is reduced. Using Splunk in networks can also reduce the workload. This is done by using forwarders that send the log messages to one or multiple central servers which stores the messages. Searches of log messages in Splunk are performed by using a graphical interface. Searches in ELK is done by using a REST-API which can be used by external systems as well, to retrieve search results. Splunk also has a REST-API that can be used by external sys- tems to receive search results. The research revealed that ELK had a lower search time than Splunk. However, no method was found that could be used to measure the indexing time of ELK, which meant that no comparison could be made with respect to the indexing time for Splunk. For future work there should be an investigation whether there is any possibility to measure the indexing time of ELK. Another recommendation is to include more log management sys- tem in the research to improve the results that may be suitable candidates for the company Telia. An improvement suggestion as well, is to do performance tests in a network with multiple servers and thereby draw conclusions how the performance is in practice.

Does a Role Exist for Tilting-Guided Therapy in the Management of Neurocardiogenic Syncope?

PURPOSE: Upright tilt-table testing (UTT) is an useful method for identifying patients with neurocardiogenic syncope, but its role in the evaluation of therapeutic efficacy is controversial. The aim of this study was to determine the correlation between negative UTT after therapy introduction (acute efficacy) and symptom recurrence during follow-up (chronic efficacy). METHODS: We studied 56 severely symptomatic patients (age 27±19 years) with recurrent (7±12 episodes) neurocardiogenic syncope (positive UTT). Once empirical pharmacological therapy was initiated, all patients underwent another UTT (therapeutic evaluation test - TET). Therapy was not modified after TET results. The probability of symptom recurrence was analyzed with the Kaplan-Meier method and compared by log-rank test in patients with negative and positive TET. RESULTS: Negative UTT after therapy was related to a significantly lower probability of recurrence during follow-up (4.9 versus 52.4% in 12 months, P<0.0001). CONCLUSION: A good correlation exists between acute and long-term efficacy of pharmacological therapy for neurocardiogenic syncope, so that serial UTT may be considered a good method for identifying an effective therapeutic strategy.

Effectiveness of a nurse-led case management home care model in Primary Health Care. A quasi-experimental, controlled, multi-centre study

Background Demand for home care services has increased considerably, along with the growing complexity of cases and variability among resources and providers. Designing services that guarantee co-ordination and integration for providers and levels of care is of paramount importance. The aim of this study is to determine the effectiveness of a new case-management based, home care delivery model which has been implemented in Andalusia (Spain). Methods Quasi-experimental, controlled, non-randomised, multi-centre study on the population receiving home care services comparing the outcomes of the new model, which included nurse-led case management, versus the conventional one. Primary endpoints: functional status, satisfaction and use of healthcare resources. Secondary endpoints: recruitment and caregiver burden, mortality, institutionalisation, quality of life and family function. Analyses were performed at base-line, and at two, six and twelve months. A bivariate analysis was conducted with the Student's t-test, Mann-Whitney's U, and the chi squared test. Kaplan-Meier and log-rank tests were performed to compare survival and institutionalisation. A multivariate analysis was performed to pinpoint factors that impact on improvement of functional ability. Results Base-line differences in functional capacity – significantly lower in the intervention group (RR: 1.52 95%CI: 1.05–2.21; p = 0.0016) – disappeared at six months (RR: 1.31 95%CI: 0.87–1.98; p = 0.178). At six months, caregiver burden showed a slight reduction in the intervention group, whereas it increased notably in the control group (base-line Zarit Test: 57.06 95%CI: 54.77–59.34 vs. 60.50 95%CI: 53.63–67.37; p = 0.264), (Zarit Test at six months: 53.79 95%CI: 49.67–57.92 vs. 66.26 95%CI: 60.66–71.86 p = 0.002). Patients in the intervention group received more physiotherapy (7.92 CI95%: 5.22–10.62 vs. 3.24 95%CI: 1.37–5.310; p = 0.0001) and, on average, required fewer home care visits (9.40 95%CI: 7.89–10.92 vs.11.30 95%CI: 9.10–14.54). No differences were found in terms of frequency of visits to A&E or hospital re-admissions. Furthermore, patients in the control group perceived higher levels of satisfaction (16.88; 95%CI: 16.32–17.43; range: 0–21, vs. 14.65 95%CI: 13.61–15.68; p = 0,001). Conclusion A home care service model that includes nurse-led case management streamlines access to healthcare services and resources, while impacting positively on patients' functional ability and caregiver burden, with increased levels of satisfaction.

Clinical management and outcome of histologically verified adult brainstem gliomas in Switzerland: a retrospective analysis of 21 patients.

Because of low incidence, mixed study populations and paucity of clinical and histological data, the management of adult brainstem gliomas (BSGs) remains non-standardized. We here describe characteristics, treatment and outcome of patients with exclusively histologically confirmed adult BSGs. A retrospective chart review of adults (age >18 years) was conducted. BSG was defined as a glial tumor located in the midbrain, pons or medulla. Characteristics, management and outcome were analyzed. Twenty one patients (17 males; median age 41 years) were diagnosed between 2004 and 2012 by biopsy (n = 15), partial (n = 4) or complete resection (n = 2). Diagnoses were glioblastoma (WHO grade IV, n = 6), anaplastic astrocytoma (WHO grade III, n = 7), diffuse astrocytoma (WHO grade II, n = 6) and pilocytic astrocytoma (WHO grade I, n = 2). Diffuse gliomas were mainly located in the pons and frequently showed MRI contrast enhancement. Endophytic growth was common (16 vs. 5). Postoperative therapy in low-grade (WHO grade I/II) and high-grade gliomas (WHO grade III/IV) consisted of radiotherapy alone (three in each group), radiochemotherapy (2 vs. 6), chemotherapy alone (0 vs. 2) or no postoperative therapy (3 vs. 1). Median PFS (24.1 vs. 5.8 months; log-rank, p = 0.009) and mOS (30.5 vs. 11.5 months; log-rank, p = 0.028) was significantly better in WHO grade II than in WHO grade III/IV tumors. Second-line therapy considerably varied. Histologically verification of adult BSGs is feasible and has an impact on postoperative treatment. Low-grade gliomas can simple be followed or treated with radiotherapy alone. Radiochemotherapy with temozolomide can safely be prescribed for high-grade gliomas without additional CNS toxicities.

Vertical Clearance Restrictions on Primary Roads and Primary Road Extensions: Standard U.S. Measurements [Vertical Clearance Log], May 1, 2015

The Vertical Clearance Log is prepared for the purpose of providing vertical clearance restrictions by route on the primary road system. This report is used by the Iowa Department of Transportation’s Motor Carrier Services to route oversize vehicles around structures with vertical restrictions too low for the cargo height. The source of the data is the Geographic Information Management System (GIMS) that is managed by the Office of Research & Analytics in the Performance & Technology Division. The data is collected by inspection crews and through the use of LiDAR technology to reflect changes to structures on the primary road system. This log is produced annually.

Formulation and delivery of the bacterial antagonist Bacillus subtilis for management of lentil vascular wilt caused by Fusarium oxysporum f. sp lentis

Different formulations of Bacillus subtilis were prepared using standard laboratory protocols. Bacillus subtilis survived in glucose and talc powders at 8.6 and 7.8 log(10) CFU/g, respectively, for 1 year of storage at room temperature compared with 3.5 log(10) CFU/g on a peat formulation. Glasshouse experiments using soil and seed treatments were conducted to test the efficacy of B. subtilis for protecting lentil against the wilt disease caused by Fusariumoxysporum f. sp. lentis. Seed treatments with formulations of B. subtilis on glucose, talc and peat significantly enhanced its biocontrol activity against Fusarium compared with a treatment in which spores were applied directly to seed. The formulations decreased disease severity by reducing colonization of plants by the pathogen, promoting their growth and increased the dry weight of lentil plants. Of these treatments the glucose and talc-based powder formulations were more effective than the peat formulation and the spore application without a carrier. It was shown that the B. subtilis spores applied with glucose were viable for longer than those applied with other carriers. Seed treatment with these formulated spores is an effective delivery system that can provide a conducive environment for B. subtilis to suppress vascular wilt disease on lentil and has the potential for utilization in commercial field application.

Connectivity management and dynamic context grouping in mobile heterogenous systems

In the last 10 years the number of mobile devices has grown rapidly. Each person usually brings at least two personal devices and researchers says that in a near future this number could raise up to ten devices per person. Moreover, all the devices are becoming more integrated to our life than in the past, therefore the amount of data exchanged increases accordingly to the improvement of people's lifestyle. This is what researchers call Internet of Things. Thus, in the future there will be more than 60 billions of nodes and the current infrastructure is not ready to keep track of all the exchanges of data between them. Therefore, infrastructure improvements have been proposed in the last years, like MobileIP and HIP in order to facilitate the exchange of packets in mobility, however none of them have been optimized for the purpose. In the last years, researchers from Mid Sweden University created The MediaSense Framework. Initially, this framework was based on the Chord protocol in order to route packets in a big network, but the most important change has been the introduction of PGrids in order to create the Overlay and the persistence. Thanks to this technology, a lookup in the trie takes up to 0.5*log(N), where N is the total number of nodes in the network. This result could be improved by further optimizations on the management of the nodes, for example by the dynamic creation of groups of nodes. Moreover, since the nodes move, an underlaying support for connectivity management is needed. SCTP has been selected as one of the most promising upcoming standards for simultaneous multiple connection's management.