A carregar...
Publicação
Security Command HUB: Automação da gestão de vulnerabilidades e planeamento de testes de segurança integrados com a CMDB da Euronext
| Nome: | Descrição: | Tamanho: | Formato: | |
|---|---|---|---|---|
| 5.71 MB | Adobe PDF |
Autores
Orientador(es)
Resumo(s)
Atualmente, organizações de grande dimensão gerem múltiplos ativos tecnológicos, como
aplicações, instâncias e bases de dados, através de Configuration Management Databases
(CMDBs) corporativas, como o Jira Service Management.
A equipa de segurança da Euronext é responsável pela validação e proteção desses ativos,
assegurando a execução periódica de testes conforme a criticidade definida para cada um.
Contudo, os processos de planeamento de testes de segurança e de atualização de inventário
eram ainda conduzidos manualmente, recorrendo a folhas Excel, o que originava erros, atrasos
e perda de rastreabilidade.
Em simultâneo, a informação sobre vulnerabilidades encontrava-se dispersa por várias fontes,
exigindo agregação e qualidade de dados para suportar decisões de mitigação eficazes,
conforme estabelecido no Digital Operational Resilience Act (DORA).
O problema central consistia na automação e orquestração da recolha de inteligência de
vulnerabilidades e o planeamento de avaliações de segurança de forma integrada com a CMDB,
garantindo precisão, escala e redução de esforço manual.
Neste contexto, foi concebido e implementado o Security Command Hub, um sistema
composto por dois módulos complementares: o Security Automation Service (SAS), responsável
pela integração e enriquecimento de vulnerabilidades provenientes de múltiplas fontes, e o
Resilience Testing Framework (RTF), orientado à gestão e planeamento automatizado de ativos
e avaliações de segurança.
A solução adotou uma arquitetura moderna e escalável, baseada em microserviços,
contentores e pipelines de CI/CD, com integração nativa com o Jira Service Management.
A abordagem foi validada através de uma prova de conceito em ambiente controlado, em
colaboração com a equipa de segurança da Euronext. A avaliação experimental demonstrou
melhorias estruturais no fluxo operacional, na qualidade dos dados consolidados, na coerência
do planeamento automático e na rastreabilidade entre ativos, vulnerabilidades e assessments,
contribuindo para o cumprimento dos requisitos de conformidade definidos pelo DORA.
Large organizations currently manage multiple technological assets — such as applications, instances, and databases — through corporate Configuration Management Databases (CMDBs), such as Jira Service Management. The Euronext Security Team is responsible for validating and protecting these assets, ensuring the periodic execution of security tests according to each asset’s defined criticality. However, security test planning and inventory update processes were still performed manually, using spreadsheets, which led to errors, delays, and lack of traceability. At the same time, vulnerability information was scattered across several sources, requiring data aggregation and quality assurance to support effective mitigation decisions, as outlined in the Digital Operational Resilience Act (DORA). The core problem consisted of automating and orchestrating the collection of vulnerability intelligence and the planning of security assessments, fully integrated with the CMDB, ensuring accuracy, scalability, and reduced manual effort. To address this problem, the Security Command Hub was designed and implemented – a system composed of two complementary modules: the Security Automation Service (SAS), responsible for vulnerability integration and enrichment from multiple sources, and the Resilience Testing Framework (RTF), focused on automated asset management and security assessment planning. The solution adopted a modern and scalable architecture, based on microservices, containers, and CI/CD pipelines, with native integration with Jira Service Management. The proposed approach was validated through a proof of concept in a controlled environment, in collaboration with the Euronext Security Team. The experimental evaluation demonstrated structural improvements in the operational workflow, in the quality of consolidated vulnerability data, in the consistency of automated planning, and in the traceability between assets, vulnerabilities, and assessments – contributing to the compliance requirements defined by DORA.
Large organizations currently manage multiple technological assets — such as applications, instances, and databases — through corporate Configuration Management Databases (CMDBs), such as Jira Service Management. The Euronext Security Team is responsible for validating and protecting these assets, ensuring the periodic execution of security tests according to each asset’s defined criticality. However, security test planning and inventory update processes were still performed manually, using spreadsheets, which led to errors, delays, and lack of traceability. At the same time, vulnerability information was scattered across several sources, requiring data aggregation and quality assurance to support effective mitigation decisions, as outlined in the Digital Operational Resilience Act (DORA). The core problem consisted of automating and orchestrating the collection of vulnerability intelligence and the planning of security assessments, fully integrated with the CMDB, ensuring accuracy, scalability, and reduced manual effort. To address this problem, the Security Command Hub was designed and implemented – a system composed of two complementary modules: the Security Automation Service (SAS), responsible for vulnerability integration and enrichment from multiple sources, and the Resilience Testing Framework (RTF), focused on automated asset management and security assessment planning. The solution adopted a modern and scalable architecture, based on microservices, containers, and CI/CD pipelines, with native integration with Jira Service Management. The proposed approach was validated through a proof of concept in a controlled environment, in collaboration with the Euronext Security Team. The experimental evaluation demonstrated structural improvements in the operational workflow, in the quality of consolidated vulnerability data, in the consistency of automated planning, and in the traceability between assets, vulnerabilities, and assessments – contributing to the compliance requirements defined by DORA.
Descrição
Palavras-chave
Security vulnerability planning CMDB automation service management Euronext Segurança Vulnerabilidades Planeamento Automação Gestão de serviços