Log management in the age of compliance
'Bread crumbs' are key to what's happening with your network
Computerworld - With each high-profile data breach (such as those at The TJX Companies and the U.S. Department of Agriculture) or new regulation, security emphasis seems to shift away from the traditional "keep bad guys out" mentality and toward a layered, in-depth, "What's going on in here?" look at IT activity. Organizations are turning to logs to provide a continuous trail of everything that happens with their IT systems and, more importantly, with their data.
Logs of different types are generated from different sources at an astounding rate, allowing for a detailed -- if sometimes cloudy -- picture of IT activity. If a disgruntled employee with an intent to steal data accesses a database containing confidential information, there would likely be a log of that activity that someone could review to determine the who, what and when. Logs provide the bread crumbs that organizations can use to follow the paths of all of their users, bad-intentioned or not.
It follows that managing these logs can benefit an organization in many ways. They offer situational awareness and help organizations pinpoint new threats as well as allow their effective investigation. Routine log reviews and in-depth analysis of stored logs are beneficial for identifying security incidents, policy violations, fraudulent activity and operational problems shortly after they have occurred, as well as for providing information useful for resolving such problems.
Given the inherent benefits of log management, it is not surprising that log data collection and analysis is generally considered a security industry "best practice." However, a number of regulations also explicitly call for the collection, storage, maintenance and review of logs, turning log management from a "should do" to a "must do." Some of these regulations rely on National Institute of Standards and Technology Computer Security Special Publications (NIST SP) to delineate the detailed logging requirements.
In my previous article, I described the way in which three regulations (FISMA, HIPAA and PCI-DSS) affect incident-response processes. This triumvirate also affects log management, since they call for enabling logging as well as for log review.
The Federal Information Security Management Act of 2002 (FISMA)
While many criticize FISMA for being all documentation and no action, the law simply emphasizes the need for each federal agency to develop, document and implement an organizationwide program to secure the information systems that support its operations and assets. NIST SP 800-53, Recommended Security Controls for Federal Information Systems, describes log management controls including the generation, review, protection and retention of audit records, plus steps to take in the event of audit failure.
NIST 800-92, Guide to Computer Security Log Management, also created to simplify FISMA compliance, is fully devoted to log management. It describes the need for log management in federal agencies and ways to establish and maintain successful and efficient log management infrastructures -- including log generation, analysis, storage and monitoring.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!