Building a Minimal Open Source Security Stack for Infrastructure Protection
Full protection of corporate infrastructure today is difficult to achieve without commercial security tools. However, startups, small organizations, and budget-constrained companies often turn to open source solutions as a compromise. This guide focuses on building a minimal security stack that addresses core information security tasks using freely available tools.
A basic stack must cover several key areas: protection of endpoints to detect malware and workstation compromise, network perimeter defense and traffic control, centralized collection and analysis of security events, and user access management through proper authentication and rights separation. The recommendations are intended as a starting point for small infrastructures rather than a complete substitute for enterprise products.
Antivirus Protection
ClamAV is one of the best-known open source antivirus engines with cross-platform support for Linux, Windows, and macOS. On Windows, the graphical frontend ClamWin is available. It is frequently used to scan mail traffic and file repositories in addition to endpoint protection. Other options include the OpenAntiVirus Project and KicomAV.
Installation on Linux uses the commands: apt-get update followed by apt-get install clamav clamav-daemon. Services clamav-freshclam and clamav-daemon handle signature updates and scanning. On Windows, the standard installer is used, and recursive scans are performed with clamscan --recursive.
Network Perimeter Protection
Popular open source firewalls include pfSense, built on FreeBSD with the PF packet filter, its fork OPNsense, and the proxy server Squid. pfSense supports installation of Snort and Suricata for intrusion detection and prevention, as well as Squid for web traffic filtering. Key features encompass multi-WAN load balancing, VPN servers (IPsec, OpenVPN, L2TP, TINC), DHCP services, HAProxy publishing, captive portal support, and log forwarding to external SIEM systems.
Rules for Snort or Suricata can be loaded from ET Open or official VRT feeds. The system can operate in IDS mode for logging only or IPS mode for active blocking. Logs are forwarded via the Status → System Log → Settings section.
Security Event Collection and Analysis
The ELK Stack (Elasticsearch, Logstash, Kibana) enables custom SIEM construction. Logstash and Ingest Pipelines normalize events, while threshold and EQL rules support correlation of authentication failures or suspicious sequences. Wazuh offers a more integrated platform with built-in vulnerability scanning, file integrity monitoring, EDR-like capabilities, and direct mapping to the MITRE ATT&CK framework for threat hunting and IOC enrichment.
Access Management and Authentication
Keycloak provides single sign-on using OAuth2, OIDC, and SAML standards. It authenticates users, issues JWT tokens, and supports integration with LDAP or Telegram. Configuration involves creating an OpenID Connect client, setting valid redirect URIs, and mapping roles in the target application such as Kibana.
These open source components together form a functional baseline for small environments, but they must be tuned to the specific infrastructure, kept updated, and sourced only from active, reputable projects.
Related articles
Building a Cybersecurity News Aggregator: Story Clustering, Seven Importance Signals and Strict Filtering Thresholds
The idea for an information security news aggregator emerged years ago with the goal of delivering only the most relevant stories while eliminating noise. Early versions relied on the rut5_base_sum_gazeta summarization model and TextRank for importance scoring, but performance remained unsatisfactory. The current system processes roughly one thousand items daily from more than 200 sources and publishes only about 0.5 percent of them. A hybrid approach now combines a transparent seven-feature formula that scores story importance with an LLM that removes irrelevant content and generates concise summaries. The formula incorporates signals such as confirmation count, CVSS severity, exploitation status from KEV, source tier, proximity to Russian readers, depth of analysis, and publication speed. Penalties are applied for vendor self-promotion, webinars, and job postings. Stories are clustered using CVE identifiers, shared trigrams, and named entities to avoid duplicate posts while preserving original reporting.
Internal DNS as Control Plane: Why Resolvers Matter More Than They Seem
Cloudflare has announced the general availability of Cloudflare Internal DNS for corporate clients of Cloudflare Gateway. The service combines public and internal DNS with a protective resolver, structured around three core objects: internal zones, views, and resolver policies. The article explains how typical hybrid infrastructures suffer from fragmented DNS layers that lead to resolution failures often misdiagnosed as balancer or VPN issues. It emphasizes that DNS serves as an early control point in zero-trust environments because it decides whether a service exists and which address is returned before any connection is established. The model separates data plane from management plane, requiring unified change channels, auditing, and observability to remain effective. Practical recommendations include avoiding manual edits across servers, using infrastructure-as-code for consistency, and integrating with systems such as NetBox for desired-state management.
Russian Government Rules Out TikTok Transformation for Gosuslugi Portal
Vice Prime Minister Dmitry Grigorenko stated that Russian authorities have no current plans to convert the Gosuslugi state services portal into a TikTok analogue. Speaking at the Eastern Economic Forum, Grigorenko described such a transformation as something beyond reasonable limits while noting that the idea could become acceptable in the future. The government aims to evolve Gosuslugi into a universal digital ecosystem that includes a social network with local communities, an events aggregator, and family chats by 2035. These features are intended to unite citizens, businesses, and state bodies in a trusted interaction space. Minister of Digital Development Maksut Shadaev has previously described the portal's goal as becoming a major social media platform. Officials emphasize that vertical video content such as tax deduction оформление remains off the table for now.
RANEPA Opens Specialized IT Laboratory for Training Specialists in Russian Software
The Presidential Academy of National Economy and Public Administration (RANEPA) has launched a dedicated IT laboratory focused on Russian software and infrastructure management. The facility was established with support from RED SOFT, R7, and ICL Techno, equipping 15 OSiO mini-PCs and monitors with RED OS and R7 Office. Students will gain hands-on experience from operating system installation through virtualization, database administration, and office productivity tasks. The project includes four specialized courses on RED OS, permanent software licenses with updates and support, and opportunities for developer certificates and internships. The laboratory will primarily serve students from the Institute of Public Service and Management and the Institute of Economics, Mathematics and Information Technologies, covering topics such as digital literacy, data management, artificial intelligence, and municipal analytics. RANEPA aims to maintain at least 90 percent utilization of the specialized classroom.