🖥️ Bringing the Real World to the Classroom: Exploring SIEM with TailScale

Disclaimer
This blog post is for educational purposes only and does not constitute an endorsement of TailScale SIEM by the author or the university.

Client Visibility in the Admin Console

Abstract
Instructing students in Cybersecurity Operations requires a balance between theoretical knowledge and practical application. This blog post details incorporating a free, cloud-based Security Information and Event Management (SIEM) solution, TailScale SIEM, into a Continuing Studies Cybersecurity Operations course at a prestigious Toronto research university. While the course lacks a dedicated lab environment, TailScale SIEM provides students with a real-world working sample to enhance their understanding of SIEM concepts and functionalities.

Key Takeaways for Aspiring Cybersecurity Professionals

SIEM Fundamentals

• This exploration of TailScale SIEM reinforces the importance of SIEM solutions in modern cybersecurity operations. It demonstrates how SIEMs aggregate and analyze data from various security tools, providing centralized visibility into potential threats and security incidents.

Real-World Application

• Students gain valuable experience navigating a real-world SIEM platform even without a traditional lab environment. This hands-on approach allows them to explore features like log collection, security event correlation, and incident management — all crucial aspects of a SOC professional’s skillset.

Accessibility and Cost-Effectiveness

• The use of TailScale SIEM highlights the availability of free and open-source SIEM solutions for educational purposes. This demonstrates the increasing accessibility of security tools, empowering future professionals who may not have access to expensive commercial solutions.

Limitations of TailScale SIEM

• Client Installation and User-Friendliness
• While TailScale SIEM itself is easy to set up as a SaaS (Software-as-a-Service) solution, there can be challenges with client installation. The current system might require users to log in with their personal Gmail ID account, which could be a privacy concern or introduce additional login steps depending on the organization’s security protocols.

Windows Client Installation
For the Windows Client Installation — just click the ADD button in the TailScale admin console, then copy/paste the URL link to the Windows client and double-click it. Then will ask you to log-in your admin credential.

Download Windows client installer

PE file for client installer

Linux Client Installation
It’s the same thing with the Linux client installation –copy/paste the link for the shell script and follow the next steps it will provide.

Linux client installer

Linux installation procedure

Machine details — Windows client

Machine details — Linux client

Conclusion
By incorporating a free cloud-based SIEM like TailScale, instructors can bridge the gap between theoretical knowledge and practical application in a classroom setting. This approach fosters a more holistic and engaging learning experience for students, preparing them for the realities of working in cybersecurity operations.

Beyond the specific case of TailScale SIEM, this blog post emphasizes the importance of adopting innovative strategies to bring real-world experiences into the classroom, even with limitations. This commitment to practical learning empowers students entering cybersecurity’s dynamic and ever-evolving landscape.