Cyber Defense eMagazine May 2019

It’s All About The Logs
Looking into Your Past Will Secure Your Network’s Future
By Gary Brown, Principal Consultant/CISO, Mosaic451
We see it repeatedly. The newly installed CISO or CIO installs the latest blinky-box in “the quadrant.” As
they discuss all the great features and how it’s going to help protect their network, it’s discovered that
while the device will get MOST of the logs, but there are still areas that aren’t logging. Plus, nothing in
the back end network getting aggregated and processed either.
A better investment of time and resources would be to get the entire network logging to a centralized log
aggregator before organizations spend cash on the trendy blinky-box. Without a complete picture of your
network, you get partial information, which can be misleading. Many CISOs understand this when it’s
presented, but surprisingly many don’t understand the importance of proper logging.
Complete and accurate logs are the keystone of any effective information security program. Almost every
aspect of infosec touches logs at some point. If you can’t query the activity of every device on your
network, dedicate yourself to getting that fixed - quickly. Don’t waste money on a SIEM or a honeypot or
anything else before you’ve addressed this Infosec 101 prerequisite first.
Many network admins don’t seem to care if their backend machines get broken into, they care about
production. Most companies with this approach do not have truly separate networks. They have VPN
connections, bastion firewalls, or other protections that allow them to restrict access, but inevitably their
production users live eat and breathe on the backend as well. They usually get their emails, do time cards,
file expenses, and so on, all on the same machine that their VPN connections are made from or their
bastion host passwords are typed from. If malware is on that machine grabbing credentials and the
security analysts are blind to that, then they very well might not notice anything amiss on the production
side. There won’t be failed logins to alert on as the attacker will have the credentials. Don’t fall into that
trap. Monitoring your backend is as critical as your production network. You are only as strong as your
weakest link, and logging is how you identify your vulnerable spots.
If you are pretty sure you’ve got your devices all ready to log to an aggregator, make sure all your other
ducks are in a row.
81