When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?


Simply put, the Integrity of the system is more valuable than its Availability.

This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place.

The alternative would allow someone to generate spurious security event log messages, then when the log was full, perform an actual attack and breach the system somehow, without it being logged because the log was full.

| improve this answer | |
  • 1
    Of course, then by preventing a theoretical security issue you create a very simple and reproducible denial-of-service exploit (by design). Wouldn't it be fun if causing the server to shut down you actual enable an attack against another machine. Oh security is fun. – tylerl Sep 23 '12 at 7:40
  • 1
    @tylerl Given how cheap storage is nowadays, the simple solution would be to always ensure enough that there is enough storage for logging. – user10211 Sep 23 '12 at 7:49
  • @TerryChia which then makes this whole discussion moot – tylerl Sep 23 '12 at 8:03
  • 2
    I'm reminded of Stephen Northcutt's story about how, many years ago, while consulting for the Navy, he told the base commander that they were under a Denial-of-Service attack but were handling it without downtime; the base commander ordered him to take them off the Internet immediately as a protective measure. – gowenfawr Sep 23 '12 at 14:16
  • 1
    @GdD That still presents an integrity tradeoff. If the log file erases the oldest record after reaching a certain capacity, all an attacker needs to do to hide his activity (if he doesn't want to - or can't - just flat-out delete the log file) is to generate enough noise to overfill the log after he's done whatever he wants to hide. – Iszi Sep 24 '12 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.