When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?
Simply put, the Integrity of the system is more valuable than its Availability.
This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place.
The alternative would allow someone to generate spurious security event log messages, then when the log was full, perform an actual attack and breach the system somehow, without it being logged because the log was full.
|show 2 more comments|