| It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Associating event types with detected events in the logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured firewall. Without this capability, it would be difficult to establish, correlate, and investigate the events related to an outage or attack.
Please note the distinction between logging and auditing; they are not the same, but they are closely related; auditing is a part of logging. Logging is recording data about events that take place in a system, while auditing is the use of log records to identify security relevant information such as system or user accesses. In short, log records are audited to establish an accurate history. Without logging, it would be impossible to establish an audit trail.
Inbound connection attempts, if denied, must be logged. Inbound connection attempts, if permitted, should be logged. This is important since it provides information concerning both successful and unsuccessful penetration attempts (providing greater threat intelligence) and allows firewall administrators to verify that rule sets/ACLs are properly configured.
Outbound connections must be logged if they are not consistent with the policies of the system or enclave. This includes attempts by users to access restricted sites, traffic that is not part of the system baseline (described in the Interface Design Document for the system), and other violations of policy or best practices. |
