Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?

When would you consider a SaaS /hosted solution and what value add should that provide?

share|improve this question
    
Are you referring only to storage of log data, or also a SIEM / log analysis service? –  AviD Nov 23 '10 at 22:03
    
I would think the more sensitive topic is the storage of log data in the cloud. What are your thoughts? –  makerofthings7 Nov 23 '10 at 22:05
    
It is a worry when you look at services such as Loggly - would you trust them with your log data? But if Iron Mountain offer it would you trust them? After all, they might have all your other data :-) –  Rory Alsop Dec 2 '10 at 17:59
    
@RoryAlsop Wow, just took time to look at Loggly. Their pitch is that it's the "fun" way to handle logs. I admit, I did enjoy myself. Great point about Iron Mountain too. –  makerofthings7 Sep 30 '11 at 22:05

2 Answers 2

If the requirement is purely storage (no active analysis required), then it would seem sensible to encrypt the data using GPG/PGP or similar before sending to the offsite facility.

At that point from a security standpoint the primary issues are availability of the data to be accessed when required, so it'd be important for the provider to be able to prove that they take appropriate measures (backup, redundancy, DR/BCP, etc) to ensure that the data is available if needed.

If the idea is that the data will be processed at the 3rd party site and therefore needs to be processed in the clear, then the risks change substantially as there's a confidentiality/integrity risk as well.

So then it'd likely depend on what's in the logs, as there might be regulatory requirements for processing the information (eg, EU Data Protection Act), and the supplier would need to provide strong evidence that their security controls are at the same level or higher than the customer to ensure that the log data is appropriately managed.

share|improve this answer

My direct observation is orgs are very accepting of securely sending and storing log data in the cloud when they have no in-house security talent and desire help with analyzing the log data.

SaaS/hosted solutions appear to be gaining in popularity and trustworthiness and they can make it easier for an org to work with an outside party hired to help analyze logs.

Trust is the key comfort measure. Trusting the keeper/maintainer of the log data & the respective infrastructure is vital (be it SaaS/hosted/or managed by in-house talent).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.