Logged » Compliance

Designing A Log and Event Monitoring Program

admin — Tue, 23 Feb 2010 02:25:28 +0000

Ultimately, as with all IT security programs, log monitoring programs are designed to address risks to data confidentiality, integrity and availability. Risks come in many types: Hardware failure System compromise User error Rogue administrator An organization’s program around log & event monitoring needs to be based on the specific risks that exist in that organization. [...]

Post from: Logged - Log Management Blog

Designing A Log and Event Monitoring Program

Configuring SUDO for Effective Activity Monitoring Via Syslog

mutex — Fri, 05 Feb 2010 22:26:43 +0000

I have discussed in previous posts the importance of administrators using SUDO to provide individual accountability. SUDO provides command-by-command accounting of actions performed by administrators, with logs sent as standard syslog events looking like this: Feb 4 19:23:23 bsd sudo: jerry : TTY=pts/0 ; PWD=/usr/home/jerry ; USER=root ; COMMAND=/bin/ps -x Feb 4 19:23:34 bsd sudo: [...]

Post from: Logged - Log Management Blog

Configuring SUDO for Effective Activity Monitoring Via Syslog

Building A Program To Manage And Monitor Administrators

admin — Sun, 24 Jan 2010 21:46:24 +0000

Monitoring the activities of privileged users or server administrators is becoming a common requirement in many organizations for a few reasons: Compliance with legal or regulatory requirements, such as PCI, HIPAA, etc Performing outsourcing services to clients who require controls to prevent the service provider’s employees from causing harm to the client. A recent experience [...]

Post from: Logged - Log Management Blog

Building A Program To Manage And Monitor Administrators

Using Syslog Logs For Validation of Security Policy Compliance

admin — Fri, 07 Aug 2009 21:49:23 +0000

In a previous post, I wrote about the general use of syslog logs as a method of ensuring compliance with policy. This is a specific example of how one might use syslog to do that. As IT operations mature, particularly in regulated environments, it is not uncommon for an organization’s security policy to require controls [...]

Post from: Logged - Log Management Blog

Using Syslog Logs For Validation of Security Policy Compliance

What To Look For In A Compliance Report From Logs

admin — Tue, 21 Apr 2009 21:10:22 +0000

Reports from system logs for compliance generally have the same basic requirements regardless of the standard being measured – whether PCI, SOX or FFIEC. There are some foundational requirements for compliance reporting of logs to be considered effective: The data/time are synchronized throughout the environment. This is vital to be able to correlate events between [...]

Post from: Logged - Log Management Blog

What To Look For In A Compliance Report From Logs

Why Using A Log Management Service Might Be Right For You

admin — Sun, 19 Apr 2009 04:09:27 +0000

There are a growing number of Managed Security Service Providers (MSSP’s), such as IBM and Symantec, and Verisign, and other companies, such as Savvis, offering an outsourced service to collect and retain system logs, generally called a log management service (LMS). The initial instinct for many would be to reject such a crazy thought as [...]

Post from: Logged - Log Management Blog

Why Using A Log Management Service Might Be Right For You

Creative Use of System Logs to Ensure Policy Compliance

admin — Sat, 11 Apr 2009 03:51:39 +0000

Organizations that need to minimize the risks associated with managing technology infrastructure implement robust policies on access management, change management and the like. Having robust and well understood policies is important and expected of most organizations. However, organizations such as the FFIEC expects that financial institutions apply detective controls to affirmatively identify policy violations where [...]

Post from: Logged - Log Management Blog

Creative Use of System Logs to Ensure Policy Compliance