Hi there, I'm Guidier. I'm a technology information security enthusiast. I started my career as
an information security ninja, defending information against cyber threats using my
Jedi skills. However, I also have another side to me that comes out at night, that of
a relevant hacker. I love using my skills to support the value of open source and fairly
believe in it. I believe that technology can be used to improve people's lives, but it
can only be done if we work together and share our knowledge. That's why I'm also a strong
advocate of collaboration and openness in the technology industry. So may the open source
be with you. I will present a project we've made at the hospital where I work during the
COVID crisis. Hospital information system is really complex. It's more than 3,000 applications,
4,000 virtual machines, 2,000 people working in a critical infrastructure, seven days a
week, 24 hours a day to save people's lives. To secure this environment, we need a global
view of all elements that compose the information system to obtain a better readability and
do a better control. So we start to build a cartography based on the ANSI guide mapping
the information system. But when we look at our tools, we didn't find one that fills
our needs. Then the COVID crisis comes, all IT projects were stopped or at least slowed
down, so we took this time to work these tools, Mercator. Mercator helps organization mapping
the information system in order for them to meet operational requirements of cyber security.
It helps to build a map in five simple practical steps. It can be used by any organization
irrespective of the type, size, maturity in terms of cyber security or complexity of
the information system. It's an open source. It can be used by any organization in public
or private sector alike. So what is Mercator? Mercator is a web application that allows
you to manage the mapping of the information system as described in the information system
mapping guide from the ANSI. What is mapping? Mapping is a way to represent the information
system of an organization as well as its connection with the outside world. The term mapping
refers to a schematic representation of a set of information. Mapping is different from
inventory. Typically, you manage your asset in different inventory, but you don't know
the relations between them and the importance of relations between all these information.
In mapping, we will try to have a complete view from the outside world, from business
requirements, down to your application, your server, and your physical inventories and
your IT rooms. So Mercator is a cartographer. He's the author of the Mercator Projection,
which is a conformal projection. It keeps the angles. It's very useful in the sailing
in the 70s century. Why mapping? Mapping is essential to control the information system.
It allows you to have a knowledge of all the components of your information system to obtain
a better understanding of it by presenting it under different view. It's allowed to fulfill
the fourth challenge of digital security is to control the information system. The cartography
allows you to have a common and shared vision of the information system within the organization.
It protects the information system. Mercator mapping makes it possible to identify the
most critical and most exposed system to anticipate possible attack paths on this system and to
implement an adequate measure to ensure their protections. It's a defense of the information
systems. Mapping makes it make a more effective response in an event of an incident or a digital
attack to qualify the impact and predict the consequence of the defensive actions taken.
And then the information system resilience. Mapping makes it possible to identify the organization's
key activities to define a business continuity plan and use the same essential tools for
crisis management whenever digital or not. The map is composed of three main assets defined
in different view. First you have your ecosystem view that represents the entities of our system
which with the information interact to fulfill these functions. These are your providers,
your partners, your customers. Then you have the business view of the information system
that represents the information through the main process and information. Then all your
process, your activities, your actors. Then you have the application view that describes
the software component of the information system, the service they provide and the flow
of information between them. Then you have the administration view. This is the list
of scope and privilege of user and administrators. You have the infrastructure, the logical infrastructure
view illustrates the network partitioning including the definitions of IP address, V-land, filtering
and routing functions. And then you have the physical infrastructure that describes the
physical equipment that are used by the information system. Your mapping can be built in three
steps and at each of these steps there is a level of granularity which will fulfill some
of these information or some of these objects. The minimal grade T level 1 you have also
initial element essential for digital operations, for security operations. At level 2, the second
level of granularity, you have a digital security oriented for the mapping. The vital information
system must have a mapping which is at minimum at this level. And at level 3, you have the
findability, you have a comprehensive and detailed mapping that incorporates all digital
security requirements. This is the main screen of the applications. We have on the top the
different maturity or three maturity levels. You have a breakdown of all your object by
domain and then you have all global proportional view of all your assets of your cartography.
We have on the left on the top your sun panel. On the top panel you have the views for documentation
and on the left panel you have all the data entry. Mercator computes the maturity level.
An item, an asset in the cartography is complete if we have all the information, all the related
information within M, with other assets. For example, an asset in the cartography is not
conformed. There is no research, no responsibility, no type or there is no link between other
assets. For example, an entity without relations, a process without operations, an application
does not support any process or a server without applications. Then it computes the maturity
level. That is the conforming asset divided by the total number of assets and the percentage
represents the effort to be compliant. So the more the better.
So you have a lot of lists. In the asset you have about 20 different types of assets.
You can form all types of assets, you can sort, export them, copy. You have a lot of
form to fulfill. Rich form with RTF. You can define the link between objects. There is
a role management within that is implemented within Mercator. You can define within your
IT team the obligation to fulfill the cartography in different teams. For example, you have the
network team that will fulfill all information related to the server. You have the operating
system team that will fulfill the virtual server. You have the application manager that
will explain the application and where they are installed. So you can divide this different
role within the applications. There is a history of change. Whenever something is changed,
it's automatically traced in the applications. So this is the data model. So you have your
entities and your relations. An entity supports different processes that define business processes
and activities operations. Process use operations. At the middle you have the application that
are divided in group. Application is set on virtual servers. And these virtual servers
are on physical servers. Mercator drives the dependencies between the objects. You have
the object in a hierarchical view. You can view your macro process, your process, your
activities, which are also why your network, your VLAN and your server is in this VLAN.
You can also view the physical infrastructure with the building, the rooms, the servers,
the physical server on the bed. Mercator draws also the physical network schema. You can
define the physical link between the different elements and you can view where they are installed.
You can also explore the cartography. You select an object. You double click on the object
and it pops all links between all these objects. And you can explore all your cartography and
view what are the different links between all your assets. The main interest in the
cartography is to generate reports. So the first major report that the cartography can
do is the information system mapping report. It's a complete work document where you have
all your assets of your information system. In the hospital, my hospital is 600 pages,
imagine. And in this report, you can explore the cartography by clicking on the link. You
have an application. You can view who uses this application or where is the application
on which virtual server it is installed, on the physical server, on which building and
you can follow the link within the world documents. You can generate a list of supported entities
and their application. You have all your applications, your entities and what application they are
used. They are using. Application by group. You have all your application by group. You
can view is it a web application, is it an application, who supports, where is it installed,
on which physical server. You have a list of all your applications. You have a list
of all your physical servers. What is the size of the server? Where is it installed?
How many disks? What is it using? And you can also make projections year by year and
see how is it growing. You can analyze your security needs on different objects. It's
a list. So the application denormalize the link between macro process, process, application,
database and information. You have this on the list. You can view here if you have correctly
placed your security need in terms of confidentiality, integrity, traceability and availability
by denormalizing it. You can view your logical server configurations. List of logical servers
they configuration. What operating system? What is installed on this logical server?
Who is responsible of it? And so on. And you can finally have the inventory of all your
physical infrastructure. List of all your physical equipments. You can take this list,
go in the IT room and check if it's correctly installed in the correct place and correctly
labeled. If you have equipment that are not in the list. So this is an example of information
system mapping report with a table of contents. You have your schema and you can start browsing
through the information system. This is an example of the physical inventory with your
site, your room, your building and your examples. This is an analysis of your security needs.
So you denormalize the link between macro process, process, application, database and
you can analyze the difference in the requirement between each subject. You can track the change
made to the cartography from the last three months. You can track the update of the MAC.
I can demonstrate to an auditor that comes at your mapping update. For example, if you
have in December some new application that comes, you should have seen some change in
the cartography by the different teams. Mercator helped you in the ESA 270001 certifications.
For the inventory of assets, for the ownership of assets, for the labeling of information,
location protection of assets, change management. You can see why a change or impact of the
asset. What other assets does it impact? Capacity management. You have a view every year. You
can take a view every year of what is your capacity. You can do vulnerability management
because you know what type of operating system application you are using and you can search
and see what type of vulnerability is present in your inventory. You can do segregation
of networks, security and supply agreements, assessment of information in security events.
In case you have a security event, you can quickly search in your cartography. I heard
about this and you can directly get a certain generic cartography. You type a word. If this
word appears in the name, descriptions of type of equipment, automatically you get the
information. Availability of information processing resource. You know how many servers are using
what application and so on. So you can do it really easily. The application is available
in GitHub. It's an open source. It's used in three hospitals in Luxembourg and 10 hospitals
in France. Three admissives from French municipalities. We have for the moment 10 contributors. We
have a roadmap. We have tons of ID for the extension of Mercator. Our main ID for the
moment is a treatment plan. The treatment registry is an obligation by the GDPR. You
have all the treatment that must be in your registry. A crisis directory. Whenever you
have an incident, you would like if Mercator is not available because there is an incident.
If it's on a paper, even on paper, what are the essential assets? What are the code phone
number of your provider? What are their email address? And we plan to make a link with Monarch.
Monarch is Luxembourgish risk analysis methodology. So we can start by your asset and extract
a model of risk analysis to analyze correctly your risk. Okay. So thank you.
Okay. Do we have some questions in the room?
Thank you. So I've got a question related to application and operating specific assets
and files. So you've mentioned vulnerability management. And I wanted to ask, are you consuming
software of materials in this specific tool? And second question in addition to that would
be how do you consume that data? If so, thank you.
Okay. So for the moment, you have to enter all your assets by hand. There is no automatic
tools that can explain who are your provider, what are your main business process, what
are your inventory or physical inventory. There is no automatic tools or artificial intelligence
that can do it for you. So for the moment, you have to enter it by hand. If you have
already some Excel sheet with this document, there is an EPI, a REST EPI, which you can
use to enter or extract the information. I don't remember the second question. Did I
open to both? Any other questions somewhere? I saw some question on metrics asking what
was the URI for Mercator? Uh, it's there. UL? They're using for URI, so I'm a universal
resource identifier. I don't know what context. Okay. So no other questions? There's one.
Okay. Hi. First of all, thank you for the talk. It's not much of a question, but more
like a comment. Following what the other guy asked or talk about, because basically the
issue I see is how to populate the application. So basically you need to connect some whole
Mercator with your CMDB or to explore your network. I don't know, for instance, if it
could be with BlueHunt or whatever, I don't know, OSQuery could help also. So how do you
see that kind of connection? How could you bind Mercator with those tools that are already
existing? Is there a way or are you already thinking to create some API or I don't know
what could be like some magical way to interconnect those things? Yes. So for the moment we have
a REST EPI. You can fulfill any table that are in the Mercator database with any inventory
you already have in place. So you can make the link and update these tables automatically.
For the moment we use it, for example, for the configures of virtual machines. Every few
months we update Mercator with the configuration of virtual machines. So we don't have to do
it manually because this is a boring task that has not a lot of value. But most of the
time you have to do it manually because this information exists nowhere. For example, how
many users is it in this application? Is it a critical application? What kind of application
is it? Who uses it? What is the REST EPI of this application? All these questions have
to be fulfilled manually and it's a really important information. You have to enter because
you want to know then, okay, what are my critical applications? What are my critical business
process? This is a critical process but you choose a non-critical application. Is it normal?
You have to think about it to build this complete view of your information system using a cartography.
Okay, so one more question. One question which is related to the other one. They are available
open source inventory tools that you can use to automatically populate hardware and software
inventory by just installing an agent on computers or using one agent which does remote inventory
and use these agents and push the information into your tool. Are you considering using
this kind of software? Yes, there are so many tools that does network inventories and tools
that we do not plan to, for the moment, to build ourselves connectors with these tools.
We try to, for the moment, to improve the Mercator tools by itself. But as I said, there
is an API. If you have an inventory and you want to populate this in Mercator, well, there
is a REST API. So, only push. We have in the documentation a few examples of usage of the
API in C, in Python, in Bash, and so on. So, it's really simple to build a script from your
inventory you have to populate the Mercator database. But as I said, there are so many
tools that you don't want to be linked with the tools with specific automated tools to
fulfill the Mercator. And it's also, it's, also these automatic tools fulfill less than
10% of the job you have to do to complete your cartography. Because most of the work
you have to do is probably things you don't have already. And you cannot automate this
process of completing the cartography. You cannot, there is no artificial intelligence
that can explain you what are your critical process, what are your critical entity, what
is the relation you have with them, what are your critical applications, what are the RTO
and FPO of these applications. So, this is something you have to do by hand.
Okay, some more questions or we can end earlier. So, thank you for your talk.
Thank you.