Cyber Defense eMagazine May 2019

• Wherever possible, send all logs to a centralized log aggregator – make it the known sense of
truth. If you can, try to have your logs on a dedicated resource. That is to say, don’t use your SIEM as a
log aggregator, rather send all logs to the aggregator and have them forward to the SIEM (and whatever
other resources you need logs from).
• Ensure everything is logging. Applications, operating systems, and network/appliance traffic. Log
successes as well as failures. Be careful not to over log though. I’ve seen ambitious logging projects
collapse miserably because they simply became overwhelmed with amounts of data they had not
projected for. By throttling back from verbose logging to a more targeted approach they were able to get
back on track.
• Ensure all sensitive logs are encrypted in transmission. If an attacker can sit on the wire and read
your logs, they will be able to pick your bones clean.
• Be sure to spec your log storage devices (and budgets) properly – and plan for expansion. Logs
can be large, even with little activity. Anyone who has ever sat watching a Wireshark capture on a
Windows network will tell you that operating system is extremely chatty. It’s surprising how much disk
space you can chew up at a fast clip. Don’t size your log storage for current consumption, but also for
projected growth.
• At a minimum grab authentication events, security related events, device errors, database or file
actions, and other critical pieces of information required to grab a minimal picture of what is happening
on all machines.
• Pick a log format and stick with it. If you can, try to have all logs recorded in a common format.
This makes parsing and searching much easier for all concerned.
• Make sure your logs are redundant, backed up, and recoverable. By this I mean:
make sure your logs are able to fail over to another system if your main aggregator fails
make sure you make frequent backups, with copies being stored off site
make sure you can recover your logs; finding out you can’t during a legal discovery
process isn’t a place you want to find yourself in
• Pick a strategy that will best suit your needs. How frequently do you need to access logs, and
how far back are your average searches going? Your budget and operational requirements will drive your
decision making process.
• Ensure all devices are syncing their time to the same common source. Timestamp disparities are
an analyst’s nightmare, and render logs as potentially useless for investigative or legal use.
• IT/networking teams can very often be helpful in selling costs to the management, or even sharing
budget, as effective logs are also very effective troubleshooting tools. When something breaks, it usually
shows up in the logs pretty quickly. Wherever possible, make logging a shared vision between teams.
82