Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
1

When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?

share|improve this question

1 Answer

up vote 9 down vote

Simply put, the Integrity of the system is more valuable than its Availability.

This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place.

The alternative would allow someone to generate spurious security event log messages, then when the log was full, perform an actual attack and breach the system somehow, without it being logged because the log was full.

share|improve this answer
1  
Of course, then by preventing a theoretical security issue you create a very simple and reproducible denial-of-service exploit (by design). Wouldn't it be fun if causing the server to shut down you actual enable an attack against another machine. Oh security is fun. – tylerl Sep 23 '12 at 7:40
1  
@tylerl Given how cheap storage is nowadays, the simple solution would be to always ensure enough that there is enough storage for logging. – Terry Chia Sep 23 '12 at 7:49
@TerryChia which then makes this whole discussion moot – tylerl Sep 23 '12 at 8:03
Or simply configure the system to delete logs from the file when it gets above a certain percent full. – GdD Sep 23 '12 at 12:10
2  
I'm reminded of Stephen Northcutt's story about how, many years ago, while consulting for the Navy, he told the base commander that they were under a Denial-of-Service attack but were handling it without downtime; the base commander ordered him to take them off the Internet immediately as a protective measure. – gowenfawr Sep 23 '12 at 14:16
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.