IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.54 Logging under Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
The regulations laid down for the logging of events relevant to security can be
implemented using the "Policy" option of User Manager. In general, suitable
regulations for average protection requirements correspond to those in the
following diagram:
In addition, if data with higher protection requirements is stored and/or
processed on a computer, then successful and rejected file and object accesses
should still be recorded. This recording should be limited to files containing
information which is particularly worth protecting, together with the programs
required for processing these files, so that the log file does not become so
extensive that it can no longer be evaluated at acceptable expense.
Where higher security requirements exist, accesses and access attempts to the
registry, at least for the keys HKEY_LOCAL_MACHINE and HKEY_USERS,
should also be recorded. In the process it is advisable to record all rejected
attempts and, among the successful ones, at least the following ones which can
lead to changes in the registry:
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000