Turvallisuuteen liittyvien tapahtumien jäljitettävyys

The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:

• which data is saved on the log
• how long log data is retained

The Authority must ensure that the necessary logs are kept of the use of its information systems and of the disclosure of information from them, if the use of the information system requires identification or other log-in. The purpose of log data is to monitor the use and disclosure of data contained in information systems and to detect technical errors in the information system.

In Cyberday, the owner of the information system may be responsible for controlling the collection of log data from the information system. The organisation documents the content of the logs in more detail for those information systems for which it is responsible for technical maintenance. For other information systems, the owner, in cooperation with the system vendor, checks that the necessary logs are collected.

The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.

The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.

The logs are protected from unauthorized changes to the data and from malfunctions, which are e.g.:

• changes to the message types that can be saved
• editing or deleting log information
• exceeding log storage capacity, which can result in transactions being overwritten or not logged