Logged » Security

Determining What To Monitor

admin — Sun, 28 Mar 2010 03:32:08 +0000

Earlier in my career, I was the IT director for a medium sized enterprise and had responsibility for information security, in addition to networking, server ops, help desk, etc. I was fortunate to be able to start with a mostly clean slate and had the help of many talented and energetic thinkers. The company was [...]

Post from: Logged - Log Management Blog

Determining What To Monitor

Using Trends In Logs To Define New Security Requirements For Internet Facing Hosts

admin — Thu, 11 Mar 2010 02:53:25 +0000

I have a few servers at a colocation datacenter for running a number of sites, including this one. I have written before about detecting brute force attacks in logs. I have been watching the attacks continue in my logs, and have noticed a few things: 1. The attacks, as before, are coming from many different [...]

Post from: Logged - Log Management Blog

Using Trends In Logs To Define New Security Requirements For Internet Facing Hosts

Designing A Log and Event Monitoring Program

admin — Tue, 23 Feb 2010 02:25:28 +0000

Ultimately, as with all IT security programs, log monitoring programs are designed to address risks to data confidentiality, integrity and availability. Risks come in many types: Hardware failure System compromise User error Rogue administrator An organization’s program around log & event monitoring needs to be based on the specific risks that exist in that organization. [...]

Post from: Logged - Log Management Blog

Designing A Log and Event Monitoring Program

Configuring SUDO for Effective Activity Monitoring Via Syslog

mutex — Fri, 05 Feb 2010 22:26:43 +0000

I have discussed in previous posts the importance of administrators using SUDO to provide individual accountability. SUDO provides command-by-command accounting of actions performed by administrators, with logs sent as standard syslog events looking like this: Feb 4 19:23:23 bsd sudo: jerry : TTY=pts/0 ; PWD=/usr/home/jerry ; USER=root ; COMMAND=/bin/ps -x Feb 4 19:23:34 bsd sudo: [...]

Post from: Logged - Log Management Blog

Configuring SUDO for Effective Activity Monitoring Via Syslog

Using Syslog Logs For Validation of Security Policy Compliance

admin — Fri, 07 Aug 2009 21:49:23 +0000

In a previous post, I wrote about the general use of syslog logs as a method of ensuring compliance with policy. This is a specific example of how one might use syslog to do that. As IT operations mature, particularly in regulated environments, it is not uncommon for an organization’s security policy to require controls [...]

Post from: Logged - Log Management Blog

Using Syslog Logs For Validation of Security Policy Compliance

How To Avoid Source Spoofing In Centralized Syslog Environments

admin — Sun, 17 May 2009 20:04:48 +0000

An obvious weakness of the syslog network protocol is the ease of spoofing messages into a central syslog server. The default use of UDP as a transport and lack of any sort of authentication, in fact, make it trivial to spoof any part of a syslog message. The most concerning issue with spoofing is faking [...]

Post from: Logged - Log Management Blog

How To Avoid Source Spoofing In Centralized Syslog Environments

Establishing a Hardened Syslog Log Server

admin — Wed, 29 Apr 2009 22:58:36 +0000

Maintaining a reliable and secure repository of logs is important for many reasons: establishing a foresnic trail of evidence in the case of fraud or attack, and enabling event correlation across many devices, among others. Particularly in regulated industries, management should enact controls that prevent security, application and system logs from being tampered with. Many [...]

Post from: Logged - Log Management Blog

Establishing a Hardened Syslog Log Server

On The Importance of Centralized Windows Event Logging

admin — Mon, 27 Apr 2009 19:55:42 +0000

I was just catching up on my reading on Technorati and came across this article that details the ways attackers can cover their tracks upon compromising a Windows server. This article should serve as a warning: if your logs are not moved off to a separate server, you will lose visibility and key evidence in [...]

Post from: Logged - Log Management Blog

On The Importance of Centralized Windows Event Logging

Logging Windows Events To Syslog Using Snare

admin — Wed, 22 Apr 2009 23:28:06 +0000

There are now a bunch of commercial and open source agents that can run on a Windows system to take in Windows Event Logs and send them off to a syslog server. We’ll be looking at the Snare agent in this post. As of this writing, Snare is compatible with Windows NT, 2000, XP, 2003 [...]

Post from: Logged - Log Management Blog

Logging Windows Events To Syslog Using Snare

Why Using A Log Management Service Might Be Right For You

admin — Sun, 19 Apr 2009 04:09:27 +0000

There are a growing number of Managed Security Service Providers (MSSP’s), such as IBM and Symantec, and Verisign, and other companies, such as Savvis, offering an outsourced service to collect and retain system logs, generally called a log management service (LMS). The initial instinct for many would be to reject such a crazy thought as [...]

Post from: Logged - Log Management Blog

Why Using A Log Management Service Might Be Right For You