| Associating event types with detected events in the logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured firewall. Without this capability, it would be difficult to establish, correlate, and investigate the events related to an outage or attack. Therefore, log records must be protected from unauthorized access, including from legitimate administrators who do not have a need for this type of access. Without this protection, a compromise or loss of log data needed for incident analysis or risk assessment could result.
Alteration of logs is a common tactic of malicious actors and malicious software such as Trojan Horses or Rootkits. This is done to conceal unauthorized activity and evade detection. The permissions for log directories and files must restrict write access to a very limited group of individuals or devices. |
