NATSHELLL_BARLING Log Audit Compliance Check, with the heart of the Information Centre referring to the voice and eyes at each interview——The reason is simple. Compliance checks are not about how much your system works, they're about you.Did you leave a trace on the details that are easily overlooked?I've been involved in several college audits of technical support for the peer review, and it is often not that the big framework is missing, but that some of the seemingly unseemly log items are either missing or incomplete.
The first easy to miss entry isIP address map before and after NT conversionThe campus network uses Internet-based private IPs (like 192.168.x.x), which are used to access the Internet after conversion from NAT to public IP. Compliance requirements are that it be possible to trace back to the specific account number and MAC address where this IP was used at any one point in time, depending on the IP of a public network. This requires log systems to record not only the online behavior log (which IP is visited for) but also the NAT map log (which IP is captured at which end of which IP is accessed). Many systems record only the online behaviour log, which is missing.——Or the NAT log is on a dial-up gateway, but there is no time stamping match with the user logs of NATSHEL_AUTH_BILLING. Once public security requests are traced, the IP on the Internet have been found but no counterpart has been identified, the entire audit will be impossible.
The second one that's easy to get checked out isLog retention timeThe Cybersecurity Act and other insurances 2.0 require that the logbook be kept for at least 180 days, but"Retention"It's not defined."Just keep it on the hard drive.". The search will be conducted by asking for a live search——Like what?"Can you check the Internet records of a MAC address 180 days ago?". If your log system, in order to save storage space, archives logs over 90 days into cold storage, and it takes half an hour or even longer for queries to produce results, the inspectors may not give you that much time. The log system must ensure the heat of the record for 180 days.——The query response time is controlled at the second level. This can be done normally with cold thermal layers on storage structures——Nearly 30 days of data stored in SSD heat and 31 to 180 days of data in HDD but indexed to support rapid retrieval.
The third problem is thatValidation of Log IntegrityThe inspectors will be concerned about the fact that you have so many logs, how can they prove complete?——No tampering, no deletions, no missing time period. If only the document is on hard disk, there are no anti-polysis mechanisms, which are not counted in the context of a compliance audit. Formal practice is to sign digitally at the time of log creation or to verify Hashi, and calculate Hashi values every time after a log has been packed and stored in an independent integrity check file. This verification document can be used to verify the integrity of the logs when auditing regularly.
The fourth point where the loss is easy isRelevance of the actual name authentication record. The campus network certification now usually requires a student to be certified as a text message——Enter the cell number and ID number, which is matched to a third party real name authentication platform. Compliance checks require that any account online must find a corresponding physical identification record, which can prove that the authentication was authenticated and not created manually from the back of the system. Many items have their actual names certified in business processes, but only in the certification logs."Authentication successful"The lack of complete matching results (e.g., the Water Flow Matching, Timemarks, Matching) led to a failure to demonstrate that this certification was indeed a formal matching process at the time of the audit.
The fifth point that is easy to find isAudit logs for managing operations. Compliance audits focus not only on students ' online behaviour, but also on managers’ behavior——Who, at what time, logs in the back office, does what (create/delete/modify account numbers, modify package, export data). If an audit log is not operated on the back desk or the operating log can be deleted by the administrator itself, this is a high risk gap for compliance. The operating log must make mandatory recording, including administrator login IP, log time, type of operation, data changes before and after operations, and cannot provide the function to delete the operating log.
The sixth one, which many people hadn't noticed, was thatSecurity issues for log storageThe logbook contains a lot of personal information about the student’s cell phone number, ID number, and how to access it (which sites you visited).——It is recommended that a national secret SM4 algorithm be used for storage encryption, and that log queries require secondary authentication (a mass log can not be exported by the administrator's account code alone). If data disclosure is notified, this cost is much greater than an audit's incompetence.
Finally, a practical suggestion:It is recommended that semi-annual internal dry-runs be conductedThe audit is self-checked on a compliance basis.——The NT map is traceable, the logs from 180 days ago are quickly detected, and the integrity of the authenticated records is verified, and there are any missing management logs. The results of the mock audits are compiled into reports indicating which are met, which are gaps, and how they need to be changed. There are two advantages: one can detect and repair problems in advance; and two are that you can produce a standardized self-check report at the time of the formal audit, and the auditors will have much higher perceptions of you.