trademark

9.0 Granular Audits (cont.)
9.5 Safeguard confidentiality of information
9.5.1 Why?
To prevent audit data from reaching the wrong hands. While ensuring the integrity of
the audit emphasizes the accuracy of the information, confidentiality addresses the fact
that not everyone needs to have access to that data. This is important because audit
information contains data related to potential attackers and methods. As such, only
authorized people (typically auditors and forensic researchers) should be awarded access.
9.5.2 How?
• Ensure that audit information is stored separately (see best practice 9.9).
• Ensure that audit information can only be accessed by authorized people (see best practice
9.6).
• Consider the use of encryption to encrypt the audit information, where feasible and applicable.
9.6 Implement access control and monitoring for
audit information
9.6.1 Why?
To safeguard audit information. Audit information contains important data regarding
the “what, when and who” of system access and data use. As this information is critical
for investigations, access to this information has to be strictly controlled. Limited access
also helps to avoid tampering with audit information, which may allow the attacker to
erase his/her tracks.
9.6.2 How?
• When setting up the identity and access management process, carefully determine
who has access to audit information and consider creating a designated “auditor”
position.
• Monitor the use of this role on a regular basis, especially for exceptions or access
attempts.
• Ensure that a cohesive view of the attack is created from audit information.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
50