BENOCS Analytics Security Concept

The goal of this page is to provide understanding on how a BENOCS Analytics deployment is secured in a customer-hosted deployment. Further, it is aimed to answer questions raised by the security teams of BENOCS Analytics customers.

The “deployment” is the set of virtual machines and underlying hardware (or portion of) that supports and runs the BENOCS Analytics product.

The terms “virtual machine”, “VM”, “server” and “node” are used interchangeably on this page when referring to the machines that are used in the BENOCS Analytics deployment.

A “flow” represents the connectivity from one location in a network to the other. Firewall rules may need to be configured on specific devices to enable a particular flow.

In a customer-hosted deployment there are multiple virtual machines deployed.

Standard deployment VMs table:

BENOCS Analytics Networks:

Each VM has an internal interface connected to the Internal Analytics Network. The step00 VM on this network need outbound connectivity as per the firewall rules.

The ce00, netflow00 and dns00 VMs connect to, or receive data from the customer’s internal network. These VMs have an additional interface connected to the Customer Backbone Network. VMs on this network need connectivity as per the firewall rules.

The af00 VM has an external interface connected to the Web Frontend Access Network. The af00 has public connectivity, is logically separated from the other VMs, and needs its own outbound connectivity as per the firewall rules.

The firewall rules are divided into four sections. Three sections covers the connectivity for each of the three networks. The last section is temporary rules required for initial access and installation. These are only necessary for the initial setup.

Column Description:

• FlowNo, FlowName: Each firewall rule is numbered and associated with a particular flow to aid reference.
• Src. Entity, Dest. Entity: Describe the VM name, the customer or BENOCS infrastructure
• Src. IP, Dest. IP: These are “TBA” where the information is dynamic for a specific customer
• Src. Port, Dest. Port: Provided for TCP or UDP-based flows
• Type: Identifies the type of flow. eg: TCP, UDP
• Protocol: Describe the specific protocol transmitted
• Encryption/Notes: Additional security context for the flow

BENOCS Analytics is provided as a Software-as-a-Service (SaaS) offering. BENOCS is responsible for monitoring, maintenance and updates. To enable us to perform these tasks, we establish connectivity from the deployment back to our infrastructure. This connectivity is established for:

• ongoing monitoring and alerting (eg: disk space, RAM, process monitoring, …)
• updates for operating system, software and our product
• access for support and maintenance users

The af00 node has inbound web access. This is for web users to access the interface, and also for the automated deployment of TLS certificates via LetsEncrypt.

We logically separate the frontend from the backend. The webapp is run on af00 (frontend) and is kept logically separated from the other servers (backend). We implement this separation at multiple levels.

• Isolated Internet Connectivity: The logging, monitoring and administrative access for the frontend are all routed over a separate internet connection, removing any need to route or connect via the backend. The frontend has its own backhook for administrative access via this link.
• One-way backend-to-frontend connectivity: WebApp data is push-to-frontend only. The WebApp cannot log in to the backend servers or services.
• Limited user access: A smaller number of our users access are configured to access the frontend, further limiting exposure.

BENOCS require initial access to the VMs to kickstart the setup. Our preferred method here is direct SSH access. Once the setup is completed, these inbound connectivity points can be removed. The SSH access should be limited as per the Installation Access firewall rules. If SSH cannot be provided, a manner of direct console access must be arranged to complete the initial setup.

For on-premise customer hosting, BENOCS provide the initial installation media as ISOs. The ISOs are built from and utilize a current Ubuntu LTS operating system. Our update cadence of LTS releases is in line with Ubuntu’s 5 year support window. Operating System software updates are configured to be applied automatically.

For a deeper dive into how the software is maintained by Ubuntu, please refer to our PDF here: 20220819 – On Ubuntus Security and also reference: Canonical.NCSC.Cloud.Security.Principles.Assessment.24.06.22.1

Access to the deployment is restricted to a subset of BENOCS employees. To access the deployment, BENOCS employees require access to a VPN, then to a jump host, and only from there can connect to the step node of the deployment. The VPN is certificate-based, and each SSH jump requires a separate SSH key-pair which are additionally secured with passwords.

All customer traffic data is received, processed and remains on the deployment VMs.