The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, so most of what's written on the PCI DSS doesn't make much sense to me. To keep the scope of this question small enough, let's focus on the requirement 10.6:
Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion-detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS).
And the corresponding testing procedures:
10.6.a Obtain and examine security policies and procedures to verify that they include procedures to review security logs at least daily and that follow-up to exceptions is required. ￼￼￼￼￼￼￼￼
10.6.b Through observation and interviews, verify that regular log reviews are performed for all system components.
- What does it mean, exactly, to review logs?
- What constitutes an exception?
- What do companies usually do in case of exceptions?