MIDA

Key Features

Using the MIDA Snapshots as inputs to event correlation, analysis and continuous monitoring, MIDA provides operators, auditors and owners with real time detection of configuration changes and security events. These events can also provide provable insights that the infrastructure was running correctly for streamlined and cost effective auditing. Some key features are listed below:

Realtime and Provable AWS Change Detection Events for

• Instance Configurations
• Security Groups
• AMIs
• Elastic Block Storage
• Network Interfaces
• VPC Configurations
• Subnets
• Route Tables

Realtime and Provable Internal Machine Change Detection Events for:

• SSH Logins and Brute Force Detection
• Machine Processes Additions and Changes
• Configuration File Change
• Application Additions and Changes
• Performance Spikes and Abnormal Behavior

Realtime Configurable Alerting based on Change Detection Events.

Configurable AWS State Capture using Cryptographic Proof

Key Problem Areas and MIDA Solutions:

1. Problem: Time to detection can be measured in months or even years.

   MIDA Answer: MIDA significantly reduces time to detection by capturing configurable, accurate and concise state information

2. Problem: Meaningful Events are difficult and expensive to pinpoint with traditional mechanisms and require ever increasing resources

   MIDA Answer: : MIDA Snapshots provide granular and actionable insights and realtime event correlation for alerts

3. Problem: Attackers Can Out Maneuver Traditional Detection Mechanisms

   MIDA Answer: MIDA leverages the notion of dynamic “Systemic State Change” to continuously adapt to changes within the environment and capture state of contextual information

4. Problem: Cloud and Managed Services architectures require portable and scalable cryptographic proof of event data

   MIDA Answer: Because the Guardtime MIDA leverages the KSI Blockchain, cross boundary, scalable cryptographic proof can be achieved

5. Problem: Logs become inaccurate or merged with no ability to validate the accuracy

   MIDA Answer: MIDA captures the System State Changes in the MIDA Snapshots. These allow each granular state capture to be containerized and correlated, but forever maintain their original value.

6. Problem: Cloud infrastructures provide elastic scalability for virtual machines leading to complex accountability and awareness for monitoring services.

   MIDA Answer: The KSI Blockchain allows each participant in the blockchain to be granularly credentialed to enable true accountability and chain of custody of the MIDA Snapshots

Key Components

The MIDA Components have been designed to take a modular approach to scale and functionality. This provides flexibility and agility when deploying these for different environment sizes and whether the State Management Services are hosted in the AWS instance or remotely for managed service offerings.