Audit Log Best Practices for Information Security

Click here to get this post in PDF

As data threats continue to increase in both quantity and sophistication, security programs have become a necessity for most businesses. You probably already have a program for monitoring your security environment and tweaking relevant controls as necessary.

However, simply having the monitoring program in place is not enough evidence of continuous data security. Indeed, the program may still be vulnerable to sophisticated security breaches and other unexpected risks. Your next step is to prove to an auditor that your data environment is indeed secure.

To prove to an auditor that your platform holds its ground, you need an audit log. An audit log records all information regarding how the program is being operated.

Defining an audit log

When auditors examine your system, they’ll be checking for your current security status as well as any previous activity. Auditors want to ascertain that your business continues to maintain data security at all times, not just during a specific timeframe.

This is where audit logs come in handy. Think of an audit log as a daily diary. By definition, an audit log is a document that records information regarding the operation of your security system. It collects and records data such as destination and source addresses, user login records, timestamps, and even files that have been accessed.

With an audit log, you have the trail of evidence that an auditor would need when proving the security of your environment. Many businesses wonder which information is important to include in an audit log. While auditors may look for different individual elements, make sure your audit log includes the following information (at minimum):

• User IDs (of all users who have access to your system)
• Date and time stamps

It’s important for an auditor to trace when an event may have occurred, and who was logged in the system at that time. Therefore, your audit log should include detailed date and time records for when users accessed the system.

• Access to systems, applications and data

Your audit log should also include an access trail to systems and applications. Whether the attempted access was successful or not, the log should keep this trail to provide insight to any auditors.

Other important information to include in the logs are:

• Networks accessed
• Files accessed
• Changes to system configurations
• Events relevant to security (such as alarms, breaches, etc.)

Benefits of having an audit log

You may ask why having an audit-log is important. In addition to making it easier for auditors to confirm your network security, audit logs also come in handy for the following scenarios:

Recovering from previous threats

Because audit logs-act as a diary of events, they can be used to keep track of how a threat occurred. Security administrators can then develop an effective strategy for recovering from such intrusions.

Detecting threats before they occur

If you use and refer to your audit logs regularly, you can detect abnormal activity and prepare for a security threat before it occurs.

Evidence of events that did or did not occur

Audit logs also come in handy when you need forensic evidence. These detailed logs can provide evidence of your security-network and any events that occurred prior. Such information comes in handy, especially during lawsuits.

SOC Reporting

You can also use audit logs for SOC reporting and ensuring that your systems meet vendor management-requirements.

Best practices for audit logging

To prepare and maintain useful audit logs, there are several best practices you should follow. These include:

1. Ensuring proper log protection (via a fail sage config)?

For your logs to be beneficial, they should be adequately protected. You can prevent unauthorized access to your logs by using a “fail-safe” as opposed to “fail open” configuration.

A fail-safe system protects your logs from being interfered with in case a system failure occurs. The fail-safe mechanism can also be triggered on or off by your IT staff as necessary.

2. Integrity is key

Ensure that your audit logs are always as accurate as possible. This starts with a company culture that emphasizes data integrity. You can also use read-only files and replicas to protect your audit log data from tampering.

3. Use the right audit logging program

There are two main steps to audit logging. The first is tracking user access and activity (in the system), and the second is continuous monitoring to record any events that may occur.

To properly manage your logs at all times, use a dual-purpose audit log platform. This allows you to access both data sources from a single program.

4. Avail adequate resources

Finally, audit log data would be useless if no one was available to review it. Make sure you dedicate enough resources and staff to log management. The personnel should have enough time and tools to access and review relevant logging information.

You may also like: What Is the CISO’s Role in Risk Management?

Author Bio

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.  Learn more at ReciprocityLabs.com.