Soon I will be acquiring the event logs of the systems my company produces and expected to audit them. Multiple logs are generated from each computer and there are multiple operating systems to audit. The systems are isolated from the internet and have a significant amount of physical security, not to mention there isn't a whole lot of conventionally useful data to obtain from them anyway. Am I wrong to feel it is unreasonable and unproductive to be examining these logs? I am under the impression that any potentially malicious activity isn't necessarily going to be obvious just by looking at the logs, if it can even be detected at all. Since it seems I can be on the hook if an unreported incident was discovered, how can I possibly analyze the overwhelming amount of information headed my way without changing my job title to 'Event Log Reader'? Does software exist that can help?
A lot of software exists for this reason. And some of it can be managed by a single person, or a whole team of people. The main principle about this is:
- Identify what you will be logging.
- Identify what type of information you need (operational or security)
- Identify use cases; malicious user logs in, someone logs in at odd hours, someone who isn't supposed to allowed logs in.
- Identify with the given infrastructure how to collect these events.
- Create the alerts, plug in your email, and wait until something happens.
This type of tool that you are looking for is for Information Security purposes, although other tools of the opertaional standpoint have started to create themselves as SIEM operators. What is a SIEM? (thanks to wiki)
Security information and event management (SIEM) is a term for software and products services combining security information management (SIM) and security event management (SEM). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications.
I am not affiliated with any of these development of these tools, nor do I work for any of the companies that sell them (although I do work WITH the tools themselves).
I am going to break this down as a cost basis. From Free(ish) to Expensive, and also give you some information on identifying the type of information you are looking for within them. These will allow you to put all the data within one place and receive an email when something occurs rather then reading Event Log all day (BLEH!).
OSSIM provides all of the features that a security professional needs from a SIEM offering – event collection, normalization, and correlation. Established and launched by security engineers out of necessity, OSSIM was created with an understanding of the reality many security professionals face: a SIEM is useless without the basic security controls necessary for security visibility.
This product provides a good foundation with the ability to receive Event Log, Syslog, and other types of events, create rules, and receive alerts when something happens that you didn't want to. This is free, and coupled with there Threat Intelligence data.
This is an operational software gone security. It does some of the more basic features of correlation, the rules are easy to make and it looks flashy. It's easy to use and easy to setup. A lot of people use this free version although alerting is lacking in the free version.
- Nitro (McAfee)
This is one of the expensive ones that will require 8-10 months of configuration and build out time to make it manageable by a single user.
- ArcSight (HP)
The bohemouth that is HP's ArcSight, as beautiful and amazing as it is, it requires a lot of working to keep it running. Although it is one of the best products out there, its really expensive and likely not worth the purchase for your use case.
-- So I hope this helps you identify that it isn't difficult to configure something like this and just wait around for emails about alerts.
I am an IT auditor myself. My answer comes from experience.
Am I wrong to feel it is unreasonable and unproductive to be examining these logs?
Yes, your belief is wrong and unreasonable. Audit logs, if designed correctly to capture the most relevant information, are an invaluable tool to assist detection of fraud / data breach / employee non-compliance. Useful information would include, for example:
- Date / time of an event
- Associated user ID
- Type of event
- Source system
An additional benefit of such a system is user accountability. As example, if an account is accessed by an unauthorized person, a log should be to capture the logon date and time along with the unique user ID of the person that committed the infraction. Without this information, it is very difficult, if not impossible to prove non-repudiation, as an user can easily deny his or her actions.
Since it seems I can be on the hook if an unreported incident was discovered, how can I possibly analyze the overwhelming amount of information headed my way without changing my job title to 'Event Log Reader'?
If your company structure could possibly allow you to be responsible for unreported incidents, then your company policy violates security principle of Segregation of Duties. Segregation of duties is designed to precisely prevent such a hypothetical situation from occurring. In essence, employees with oversight responsibilities, such as yourself, should be prevented from accessing the underlying application from which the logs were generated from. If you did not have access, you can't be held accountable for unreported incidents.
Finally, if the amount of information logged is burdensome to review, then your logging technique is flawed. Logging every trivial event is the equivalent to not logging at all. It prevents critical information from being noticed in a sea of noise.