0

How can I securely store audit logs of activity from a system such as together with source data or separately off site?

  • It looks like you are trying to gather a large list of various reasons. That is not a great fit for a Q&A site. The general idea here is that it is possible to have a single acceptable answer to a question. Can you narrow your question down a bit? – schroeder May 13 '16 at 14:38
  • What do you mean by "source data"? Do you mean, for instance, keeping logs of a system not on the system? When you say "not co-located", do you mean the audit logs should not exist with the "source data" but only remotely? Or is keeping a copy locally an option? – schroeder May 13 '16 at 14:41
1

As an IT auditor, let me give you an answer from experience.

Segregation of duties - SOD

It is a good practice and core principle to segregate employees who operate or administer the system from which audit logs are produced from employees such as myself, with responsibilities to review these logs for fraud / malicious activity / security vulnerabilities. If these duties are not segregated, then a single individual can undermine the system by making a malicious change, and cover his wrongdoing by modifying the audit logs to hide his actions. To illustrate, the following individuals in general should not have access to log data.

  1. Security administrators
  2. Computer operations personnel
  3. Data base administrators

To expand on the above examples, if a security administrator has access to logs data, he can escalate his own privileges to allow for improper access greater than is appropriate for his job duties, a violation of the security principle of Least Privilege. To prevent or deter detection, he can delete and / or falsify values for log entries of date, user ID...etc. The same reasoning applies to items 2 and 3.

To prevent the aforementioned, logs can be centrally stored in a server in which access is strictly controlled to individuals with specific roles - RBAC. Periodic review of individuals having access to logs should be conducted and improper access rights should be removed immediately upon discovery.

Secure storage of logs

Log data should be backed up on a regular basis and the backup should be stored offsite away from main company operations. This is to ensure that if a disaster (ex: Fire or flood) were to occur at the main company site, data loss will be mitigated.If logs contain sensitive information, log backups should be encrypted using strong cryptography such as AES 256. A written method, such as receipts should be used to track shipping and receipt of these logs. Periodically, a reconciliation of backup media should be taken against the tracking documentation, with any failed reconciliations promptly investigated.

Monitoring procedures regarding security and confidentiality of backup storage should be documented. If these responsibilities are delegated to a third party to perform, SLAs and a contract should ideally be in place, explicitly specifying the duties of each party (Company and vendor), and ideally include a right to audit clause in the contract. Log retention length of time should be documented in a retention policy known to all individuals with a job role of handling backups.

Finally, to learn more, this is an authoritative source from ISACA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.