In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Audit logging is recording of security-significant events. It enables detection and investigation of security incidents.
Audit logs could be automatically monitored and alerts raised for suspicious activity. Alerting could be as advanced as baselining “normal” behaviour, then triggering alerts on anomalies. Fine-tuning alerting thresholds is a balancing process to minimise false alarms while maintaining vigilance.
It is a best practice to store all logs in a central location, as it allows correlation of different log records. Correlation of logs yields better security insights. It is also easier to protect one centralised records archive, rather than multiple smaller ones.
Application examples
Every time you login to your Internet Bank, at least one log record is created to document the event.
Risks
Although audit logging is crucial for security incident management, lack of thereof is hard to justify as high risk. The business impact could be slow incident recovery or overlooked attacks. Thankfully, audit logging is cheap and easy, so it does not need a lot of lobbying to implement.
There is a risk of tampering with log records, which is easy to combat with centralised logging systems and access control.
It is more likely that log records are not retained long enough to enable the investigation of past incidents. Mandatory retention period is a good compensating control for that.
Quirks
Fine-tuning of alerts requires good system knowledge and specific expertise. It is an expensive, hard to scale process. That is where machine learning or artificial intelligence can help a lot.
Further reading
Please check out the map of cyber security controls below. It is simple yet awesome.
