12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
Logs recording various events must be created, stored, protected, and analyzed to e.g. generate evidence and identify potential security incidents. The organization should establish a dedicated logging policy outlining log purposes, collected data, and protection requirements. Event logs should encompass user IDs, system activities, event timestamps, device/system identifiers, and network details.
The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:
Security systems (e.g. firewall, malware protection) often have the ability to record a log of events. At regular intervals, make sure that a comprehensive log is accumulated and try to identify suspicious activity. The log is also useful in investigating disturbances or violations.
Often, security tools provide a way to set alert policies when something potentially dangerous happens in an organization's environment. For example, Microsoft 365 has built-in alert policies to alert you to abuse of administrator privileges, malware, potential internal and external risks, and data security risks.
The organization must identify security-related events in data systems and the environments in which they operate. To respond to changes related to these events, alarm policies must be created.
Alarm policies need to be actively monitored and modified based on experience.
The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.
The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.
The logs are protected from unauthorized changes to the data and from malfunctions, which are e.g.:
System logs often contain a wealth of information, much of which is irrelevant to security monitoring. In order to identify events relevant to security monitoring, consideration should be given to automatically copying appropriate message types to another log or to using appropriate utilities or audit tools to review and resolve files.
.png)
