Lessons · Cybersecurity · logging: what to keep
Logging: what to keep, and for how long
A log is a record written at the time of who did what, from where, when, and whether it worked, kept long enough to investigate something you only notice months later.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The intrusion was found in March and the first sign of it was a login in November. The team with 90 days of logs could see a stranger already inside and no way of knowing how they got in; the team with a year could tell the whole story.
How to think about it
For each system ask whether it records logins and failures, changes to accounts and rights, administrator actions, and access to the data that matters. Send those somewhere the machine's own user cannot delete, keep at least 90 days, and keep the clocks in step.
Worked example
Keep: every login and every failure, with the source addressWho, from where, and whether it worked. The most-read log there is.
Keep: account created, rights changed, password resetThe changes an intruder makes in order to stay.
Keep: administrator commands and access to the customer databaseWhat was done with the access once they had it.
Send them to one central store, 90 days minimum, clocks in syncOff the machine, long enough, and with times you can line up across systems.
Your turn
Logs are sent off the machine that wrote them to one shared place. Write the word for that kind of store.
a log store
Solve one, graded on the server
The trap
Logging everything and reading none of it. A log nobody looks at helps only after the fact; an alert on repeated failures is what helps during.