Logging
& Monitoring Policy
Logging and Monitoring policies have a major impact in an
organization's day-to-day security. To much logging will reduce
the effectiveness or the logging as limited resources are
spread too thin. Too little logging and the organization risks
missing vital data.
Well thought out logging policies can help an organization:
Maintain the proper levels of personnel
Detect intrusions and compromises
Detect equipment failures and prevent down time.
Provide qualitative data for capacity planning
The idea is to ensure that the most important data is capture,
reviewed, and acted upon in a timely manner. Logging policies
should include notification procedures, guidelines for log
review intervals, retention standards, and response time expectations.
Logs are becoming more important and, in some cases, logging
can become a liability to an organization. By logging Internet
access, customer activity, email messaging, and other types
of logging; the organization may be asked to produce those
logs for criminal and civil investigations. It is important
that the organization have an aging policy that deletes older
logs.
Determining the information logged, the retention levels,
aging policies, the review interval, and notification procedures
an organization can reduce their risks and liabilities while
retaining more valuable information.
© 2003 Hudson Business Networks
|
