Log Management

Log management underlies all of the analytical activities that rely on system reporting. The diverse purposes of those activities demand flexibility in logging infrastructure and practices to meet the different detection, compliance, process improvement, and operational requirements. Proper planning for the management of logging activities is essential, through all phases of the information life cycle.

Logging is the primary form of instrumentation that attempts to capture signals generated by events.

Events are any kind of actions that take place within the system environment that cause some kind of measurable or observable change in one or more elements or resources within the system.

These can include:

• A user interaction at a physical control device, such as a badge reader or keypad, may require multiple steps or actions, each of which is an event;
• Connection and login attempts;
• Disconnection of sessions or logouts;
• A CPU fan shifts from one speed to another to meet temperature control demands; or
• A server shuts down, or completes a power-on boot sequence.

U.S.A

Whether such events are benign or potentially harmful is not immediately clear on an eventby-event basis.

Events (or the signals that they produce) can be further classified as precursors or indicators:

• Precursors. Signals from events that suggest a possible change of conditions (internal or external to the organization) may alter the current threat landscape. An increase in tensions in the local political or social environment, or complaints or grievances by employees or customers going viral in social media, are examples of precursors.
• Indicators. Signals from events that suggest that activity of a potential security concern is about to take place, is underway, or has occurred in the past. Alarms from intrusion detection systems (IDSs), or the failure of a server to respond to system maintenance and management "keep-alive" messages, may relate to an abnormal operating condition, attack,

intrusion, or any combination of these. Precursors are used to make near-realtime adjustments to alarm thresholds and sensitivity settings; they can also be used to increase the level of challenge required of subjects (for authentication and authorization decisions).

Indicators may trigger the need for more focused attempts to detect the presence or activities of an unauthorized user action (which may be a deliberate, intentional attacker).

Indicators of compromise (loCs), as their name suggests, signal that an intrusion, malware, or other predefined hostile or hazardous set of events is occurring or has occurred.

User attempts to bypass security controls such as software allowed or blocked list systems may indicate an attempted malware installation. Login attempts from IP addresses or regions where no authenticated users should be located might be another. loCs should be prime candidates for immediate attention by the human members of the security operations team.

Most indicators and some precursors can be captured and logged by hardware, operating systems (OSs), applications, and network management systems devices.

Every security framework covers logging expectations to some degree. NIST SP 800-92—Guide to Computer Security Log Management addresses the development of a logging practice that is broadly applicable to information systems. Similarly, ISO 27001 addresses logging in Annex A, A.12.4 Logging and Monitoring.

Well-structured log management practices address issues such as:

• Logging compliance and standards;
• Logging policies throughout the systems and information life cycles;
• Logging infrastructure;
• Log generation, collection, and normalization;
• Log protection from creation to disposition (archiving or defensible destruction); or
• Log review, analytics, and reporting.