In this lesson,
we will learn about monitoring and oversight.
Monitoring and oversight is continuously tracking
and reviewing access, authentication,
and authorization activities to ensure compliance
with security policies and detect any unauthorized
or anomalous behavior.
Monitoring and oversight concepts
include logging and auditing.
Logging captures detailed records of access
and authentication events,
such as successful logins or access attempts.
The logs are then used to track user activities
and for troubleshooting.
Auditing involves analyzing logs to assess compliance
with security policies
and identify potential security breaches
or policy violations.
Let's learn more about logging and auditing.
First, we have logging.
Logging involves collecting detailed records of events,
such as logins, access attempts, or changes to systems.
A key part of effective logging is centralized logging
where logs from various systems
and devices are gathered into one place.
One common method for centralized logging is Syslog,
a protocol that sends logs from different devices
to a central server or location.
Syslog also assigns each log message a PRI code,
which is short for priority code.
This helps categorize the log.
The PRI code is a combination of the facility
and severity levels where the facility represents the type
of system or process that generated the log,
such as an operating system, mail services,
or authentication processes.
In fact, there are 24 different facility codes,
each representing a different type of system.
For example, a facility code of zero corresponds
to kernel-generated messages
while a facility code four corresponds
to security-related logs.
Next, the second part of the PRI code is the severity level.
This indicates the importance or urgency of the event.
Severity is prioritized on a scale from zero to seven,
where zero represents an emergency,
meaning something critical that could lead
to a system failure,
and seven represents debugging information,
which is a low priority.
For instance, a system crash would have a severity level
of zero, while a failed login attempt
might have a severity level of five or six.
Next, the PRI code is calculated
by multiplying the facility number by eight
and adding the severity level.
For example, a log from a facility of four
with a severity level of five would have a PRI code of 37.
This PRI code is calculated
as four times eight plus five.
This PRI code helps central systems
and administrators quickly categorize
and handle log events based on their source and urgency.
In Syslog, the lower the severity level within the PRI code,
the higher the urgency of the log message.
Along with Syslog,
many organizations use a Security Information
and Event Management, or SIEM system to collect, categorize,
and analyze logs from multiple sources in real time.
A SIEM gathers logs from a variety of sources,
including firewalls, servers, operating systems,
applications, databases, and network devices.
These logs from different sources often come
in different formats, such as JavaScript Object Notation,
or JSON, Extensible Markup Language, or XML,
Syslog formats
or other proprietary formats unique to specific vendors.
So one of the core functions of a SIEM platform
is to normalize these logs
by converting the diverse log formats
into a common structured format.
This process ensures
that data from various sources
can be efficiently correlated and analyzed.
Without normalization, it would be very challenging
for the SIEM platform to detect patterns
across heterogeneous systems
since each system logs information in a different way.
Second, we have auditing.
Auditing goes beyond logging
and analyzing collected logs to ensure compliance
with regulations and to identify potential security risks.
One of the primary goals of auditing
is regulatory compliance.
Regularly auditing logs helps confirm that an organization
is adhering to regulations.
For example, in the healthcare industry,
organizations are required to comply
with the Health Insurance Portability
and Accountability Act or HIPAA.
This act mandates that all access
to patient data be logged and audited.
So regular audits of these logs ensure
that only authorized personnel
have accessed sensitive information
that any improper access is quickly detected.
A critical aspect of auditing
is maintaining tamper-proof audit trails.
Tamper-proof audit trails record key actions,
such as who accessed a system,
when it happened, and what was done.
It is essential that these records cannot be altered
or deleted, ensuring their integrity.
Tamper-proof technologies like blockchain
or write once, read many storage devices are commonly used
to achieve this.
In a blockchain system, each audit log is stored
in a cryptographically linked block, making it impossible
to modify past records without triggering alerts.
Similarly, write once, read many, or WORM storage,
allows data to be written to once,
preventing any future changes.
For example, in a financial institution,
transaction records could be stored
on a WORM storage system.
When a transaction is logged, it is written
to the storage device, and that entry becomes permanent.
From that point on, no one can modify
or erase the transaction,
ensuring a tamper-proof audit trail.
This is important for regulatory compliance
and for forensic investigation
because it guarantees that audit logs remain intact
and unaltered over time.
So remember, logging and auditing
are essential for monitoring
and oversight in maintaining security and compliance.
Logging focuses on collecting detailed records
of events, such as access attempts and system changes,
often centralized in systems like Syslog
or security information and event management platforms
to ensure easy management and real-time analysis.
Logs help track user activities
and are valuable for troubleshooting system issues.
On the other hand, auditing analyzes these logs
to ensure compliance with regulation
and to identify potential security risks.
A crucial aspect of auditing
is creating tamper-proof audit trails.
Tamper-proof audit trails ensure
that important records cannot be altered
or deleted, providing a reliable foundation
for investigations and compliance efforts.