The log is usually the only thing that can tell the truth when it happens. WiFi's wireless certification system produces a lot of Internet records every day: who, what time, what equipment, what to use, and what to visit. These are both compliance requirements and key evidence for security investigation. But there are many ways in which the logs are stored, how long they are stored, what they are, who can check them, and there are too many doors inside, either there's a bunch of useless ones or there's a missing bias.
Find out which logs are required by law.
The Internet log is not about leaving anything."Who's been through the IP at what time and what address?"This kind of association is recorded to the extent that it can be traced back to a specific identity. Some people think only a successful certification log exists, but there are only some."Someone's login."Not enough, and there's a log-and-checking of access behavior. When we help our clients, the first thing we do is to put out a list of necessary fields against regulatory requirements, one missing, not by feeling. The minimum legal retention period must also be confirmed that different regions may differ, so don't take a picture of yourself."Save it for three months."It's done.
Integrity and anti-pollification of logs
The logs are evidential if they can be altered. If a log is on an ordinary server that anyone can access, it has no proof of being modified or deleted after the fact. It is recommended that the logs should be written as much as possible without modification, and that the important site will either be verified by Hashi or sent to the IL server. We have seen a small place where the log and authentication system are co-mingled, we've lost one partition, and we've been missing six months of records, just in time for a review.
Storage capacity and rolling strategy to account for
Logs are going to increase and increase faster than they thought. In a medium-sized site, tens of thousands of Internet records per day are recorded as astronomical numbers according to the mandatory retention period. Designed to be clear: daily increment, total during retention, storage costs. It is common practice for hot data to be easily retrieved, cold data to be regularly archived at low cost and automatically cleaned beyond the retirement period. We usually recommend that clients do capacity measurements before they go online, so don't panic until hard disks start to throw their logs away."Save time."。
Audit interfaces are not mandatory for all units, but clear in advance
Some industry sites are required to keep logs for designated safety control or audit platforms, while others simply require local retention and access. Shouldn't take them, you cannot guess, ask the territorial authorities. We have seen two typical errors: one is a self-inflicted platform that has been used for nothing; the other is an unconnected one that has been ordered to shut down.
Anyone who can check the logbook has to have a strict authorization.
The logs are full of user behavior data, sensitive information, and no one can see it. Practically, they have to be graded: routine traffic is only for aggregate statistics, real access to a higher level of approval of a particular person's record is required, and marks are left. We've seen a unit where front-office suits can go backstage to the Internet, which is both illegal and dangerous."Application - approval - access - mark"And every specific access goes back to who, why, what. The control of the rights is loose in inches and the risk is very high.
The log and authentication records need to be connected.
The Internet behavior log is not enough; it must match the real name. That means that the end sign in the access log can be traced back to the person who certified the corresponding person."Session ID""User Identity""IP distribution"We've processed a check that has access logs and accreditation logs, but there are no common fields to link them, and we can only hand over two sets of incompatible data that require correction. The design of the connection is considered when it comes to the buildup of the library, which is almost impossible after.
Periodic Rehearsal Log Access Process
Many units have logs that are stored well, but they're busy when you want to access them: no entry, no field match, no format control. We suggest at least one exercise a year."Assuming we get a check, we'll have to hand over the IP identity and access records within two hours."The drill exposes the breakpoints of storage, association, and authorization of the links, much more than paper compliance. Log systems are not designed to deal with inspection. They have a real value when you need to prove your innocence.