trademark

9.0 Granular Audits (cont.)
database configurations, for example.
• Setup and enable the necessary audit settings of the big data infrastructure, like routers,
OS, Hadoop, and applications for which the audit information must be collected upfront.
Setup the settings for other audit information, which might be collected in a later stage.
• Collect and process the audit data with a SIEM solution or auditing tool, when
applicable.
9.3 Ensure timely access to audit information
9.3.1 Why?
To accelerate incident response. Time is the most important aspect in case of an attack, not only
to determine when the attack happened, but also to have timely access to audit information in
case it is needed. This goes hand-in-hand with the best practice mentioned in section 9.2.
9.3.2 How?
As described in best practice 9.2, setting up audit information upfront is key, not only
for the completeness of the information, but also to get access to the information in a
timely fashion.
9.4 Maintain integrity of information
9.4.1 Why?
To ensure trust in audit data. Without an integrity guarantee, there is no single version
of the truth. Audit information can’t be trusted and, as such, becomes useless.
9.4.2 How?
• Consider implementing integrity controls, like secure hashing. Use SHA-1, SHA-224,
SHA-256, and/or SHA-512.
• Ensure the integrity of the audit information is guaranteed along the complete
path of collection, processing, use and storage of the data. This helps to ensure the
information’s chain of custody.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
49