Logging Practices

should require logging its logging requirements and and analyzing the data goals. of greatest importance and have nonmandatory

Based on these, it should then develop recommendations for which policies that clearly define mandatory

other types and sources of data

requirements and suggested recommendations for log management should be logged and analyzed activities, including log generation, if time and resources permit.

transmission, storage, analysis, and disposal. In some cases, organizations choose to The organization should ensure that related have all or nearly all log data generated and policies and procedures incorporate and stored for at least a brief period, in case it is support the log management requirements needed. This favors security considerations and recommendations.

over usability and resource usage, and it also allows for better decision-making, in some

Management should provide

cases. When establishing requirements and

the necessary support for log

recommendations, organizations should management planning, policy, strive to be flexible since each system is different and will log different amounts of and procedures development.

data. Requirements and recommendations for logging should be created in conjunction with a detailed analysis of the technology and resources needed to implement and maintain them, their security implications and value, and the regulations and laws to which the organization is subject.

Prioritization of log entries is driven by organizational policies, regulatory standards, and key business requirements. What follows are four practices that should be considered key to logging.

• Prioritize log management appropriately throughout the organization. An organization should define its requirements and goals for performing logging and monitoring logs to include applicable laws, regulations, and existing organizational policies. The organization can then prioritize its goals based on balancing the organization's reduction of risk with the time and resources needed to perform log management functions.
• Establish policies and procedures
• Create and maintain a secure log management infrastructure. It is helpful for an organization to create components of a log management infrastructure and determine how these components interact. This aids in preserving the integrity of log data from accidental or intentional modification or deletion while also maintaining its confidentiality. It is also critical to create an infrastructure robust enough to handle not only expected volumes of log data but also speak volumes during extreme situations (e.g., widespread malware incident, penetration testing, vulnerability scans). Organizations should consider using security information and event management (SIEM) systems for storage and analysis

• Establish policies and procedures for log management. Policies and procedures are beneficial because they ensure a consistent approach throughout the organization and that laws and regulatory requirements are met. Periodic audits are one way to confirm that logging standards and guidelines are followed throughout the organization. Testing and validation can further ensure the policies and procedures in the log management process are properly performed.

(SIEM) systems for storage and analysis.

• Provide adequate support for all staff with log management responsibilities. While defining the log management scheme, organizations should ensure that they provide the necessary training to relevant staff regarding their log management responsibilities as well as skill instruction for the needed resources to support log management. Support also includes providing log management tools and tool documentation, providing technical guidance on log management activities, and disseminating information to log management staff.