3

Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?

When would you consider a SaaS /hosted solution and what value add should that provide?

  • Are you referring only to storage of log data, or also a SIEM / log analysis service? – AviD Nov 23 '10 at 22:03
  • I would think the more sensitive topic is the storage of log data in the cloud. What are your thoughts? – goodguys_activate Nov 23 '10 at 22:05
5

If the requirement is purely storage (no active analysis required), then it would seem sensible to encrypt the data using GPG/PGP or similar before sending to the offsite facility.

At that point from a security standpoint the primary issues are availability of the data to be accessed when required, so it'd be important for the provider to be able to prove that they take appropriate measures (backup, redundancy, DR/BCP, etc) to ensure that the data is available if needed.

If the idea is that the data will be processed at the 3rd party site and therefore needs to be processed in the clear, then the risks change substantially as there's a confidentiality/integrity risk as well.

So then it'd likely depend on what's in the logs, as there might be regulatory requirements for processing the information (eg, EU Data Protection Act), and the supplier would need to provide strong evidence that their security controls are at the same level or higher than the customer to ensure that the log data is appropriately managed.

1

My direct observation is orgs are very accepting of securely sending and storing log data in the cloud when they have no in-house security talent and desire help with analyzing the log data.

SaaS/hosted solutions appear to be gaining in popularity and trustworthiness and they can make it easier for an org to work with an outside party hired to help analyze logs.

Trust is the key comfort measure. Trusting the keeper/maintainer of the log data & the respective infrastructure is vital (be it SaaS/hosted/or managed by in-house talent).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.