trademark

9.0 Granular Audits (cont.)
9.7 Enable all required logging
9.7.1 Why?
To build up an audit view. This process is only as effective as the data collected. Most of
this information comes from log files (e.g., networks, OS, database, and applications). As
such, enabling logging according to what needs to be audited is key.
9.7.2 How?
This is related to best practice 9.2, which describes which information is needed. Based
on this data, evaluate the logging capabilities of the big data infrastructure components
and enable the different logging features.
9.8 Use tools for data collection and processing
9.8.1 Why?
To find actionable information without being overwhelmed by big data. There is simply
too much information (especially now with big data) to be processed manually. Tools—
such as a SIEM tool—are necessary to collect and process the data.
9.8.2 How?
Use available tools such as a SIEM tool to process the information gathered from logs.
9.9 Separate big data and audit data
9.9.1 Why?
To enforce separation of duties. As the audit data contains information about what has happened
in the big data infrastructure, it is recommended to separate this data from the “regular” big data.
9.9.2 How?
• Implement the audit system in a different infrastructure than the big data infrastructure.
For example, this may include a different network segment or cloud.
• Ensure that only the pre-defined “auditor” has access to the audit system and audit data.
• Monitor the audit system.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
51