Front cover - IBM Redbooks

64 Lotus Security Handbook
Security audit subsystem
The purpose of the security audit system in an IT solution is to address the data
collection, analysis, and archival requirements of a computing solution in support
of meeting the standards of proof required by the IT environment. A security audit
subsystem is responsible for capturing, analyzing, reporting, archiving, and
retrieving records of events and conditions within a computing solution. This
subsystem can be a discrete set of components acting alone, or a coordinated
set of mechanisms among the several components in the solution. Security audit
analysis and reporting can include real-time review, as implemented in intrusion
detection components, or after-the-fact review, as associated with forensic
analysis in defense of repudiation claims. A security audit subsystem may rely
upon other security subsystems in order to manage access to audit-related
systems, processes, and data, control the integrity and flow of audit information,
and manage the privacy of audit data. From Common Criteria, security
requirements for an audit subsystem would include:
► Collection of security audit data, including capture of the appropriate data,
trusted transfer of audit data, and synchronization of chronologies;
► Protection of security audit data, including use of time stamps, signing events,
and storage integrity to prevent loss of data;
► Analysis of security audit data, including review, anomaly detection, violation
analysis, and attack analysis using simple heuristics or complex heuristics;
► Alarms for loss thresholds, warning conditions, and critical events.
The closed loop process for a security audit subsystem is represented in
Figure 2-5 on page 65.