The Importance of Cybersecurity Logging
Logs are a crucial element in breach investigations. However, some investigations suffer from a lack of logs. In such cases, the company must assume the worst if no evidence can be brought to the contrary. This may require sending notifications to an entire customer base or paying large fines. Some of these notices and fines could have been avoided had logs been preserved.
In many cases, logs are not available because they are overwritten. Many devices, by default, overwrite their logs when they fill up so that only recent events can be found. Recent events, however, are often insufficient for a cybersecurity investigation that may go back months or even years.
In other cases, logs are deleted by a cybercriminal or malicious insider. A criminal may steal information and then delete the logs to cover their tracks. Similarly, a malicious admin could perform some illegal activity and then remove the logs and the evidence they contain.
It is important, therefore, for companies to have a robust logging system that retains logs and prevents log tampering. Companies can take several active steps to make critical system logs as tamper-proof as possible.
Table of Contents
- Step 1: Centralized Archiving
- Step 2: Segregation
- Step 3: Monitoring and Alerting
- Step 4: Rapid Response
- Final Thoughts
Step 1: Centralized Archiving
The first step in protecting security log integrity is to send logs to a centralized log management system for archival. Some may choose to archive logs in batches, such as on a nightly schedule. However, the best approach is to send logs to a central repository as they are created.
Batch processing can result in missing some log data if log integrity is compromised in between archival cycles. However, continually writing logs to the repository ensures that important events are tracked, even if the local copy is deleted, corrupted, or overwritten.
In the case of a breach or other event, incident response or investigative teams will need to be able to analyze the logs to piece together what happened, implement an effective response, and prevent future intrusions.