Cyber-Security-Monitoring-Guide

Cyber Security Monitoring and Logging GuidePart 3 Cyber security log managementRequirementsImportant security-related events should be recorded in logs, stored centrally, protected against unauthorised changeand analysed on a regular basis. This will help in the identification of threats that may lead to a cyber securityincident (also known as ‘indicators of compromise’ or IOCs), maintain the integrity of important security-relatedinformation and support forensic investigations.Your organisation should adopt a real time solution that automatically isolates the key events you need to know about(which you should have specifically defined), when you need to know them, so that you receive instant advice about usefulor critical matters that are no longer buried in a mountain of less important data. This will help to ensure appropriate cybersecurity-related events are identified earlier – and then analysed and actioned more quickly and effectively.Requirements for cyber security event logging should cover:• Management of event logging (eg. setting policy, defining roles and responsibilities, and reporting)• Identification of business applications and technical infrastructure systems on which event logging should beenabled, including those that have been outsourced or are ‘in the cloud’• Configuration of information systems to generate the right cyber security-related events• Regular ‘tuning’ and review to reduce the number of false positives to an acceptable level• Storage of security-related events within event logs (eg. using local systems, central servers, SIEMs or by usingstorage provided by an external service provider)• Analysis of security-related event logs (including normalisation, aggregation and correlation)• Synchronisation of time stamps in event logs to a common, trusted source• Protection of security-related event logs (eg. via encryption, access control and backup)• Defined retention requirements and/or log rotation periods• Taking necessary actions to remediate any issues identified and respond to cyber security incidents in a fast,effective manner.!Some organisations that have synchronised their logs have not actually done this aswell as they think they have, so events in certain timelines could be missed.Analysis was restricted to monitoring from a cyber security incident management perspective, but logs can also be used forcompliance and awareness purposes, covering topics like:• Monitoring/efficiency/performance• Status/asset management.!Storage solutions are often cloud-based (with doubtful or unknown securityarrangements) and the security of actual physical servers can be overlooked.Findings from project research revealed that effective logging can save you time and money if you should experience acyber security incident – and that it can also be very helpful as part of a defence (or prosecution) in a court case. Youshould therefore:• Establish cyber security-related logging standards and procedures• Configure systems to record the most important cyber-security related events and monitor these events forspecified purposes• Respond to alerts correctly (eg. to avoid overlooking indicative alerts or over-reacting to benign alerts)• Aggregate what may seem like benign alerts into what is a coherent threat message• Make appropriate event logs available to investigators in a suitable format• Retain logs according to retention standards/procedures, storing them securely for possible forensic analysis at alater date.16