Bill Roth, Ulitzer Editor-at-Large

Bill Roth

Subscribe to Bill Roth: eMailAlertsEmail Alerts
Get Bill Roth via: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn

Related Topics: Cloud Computing, Security Journal, Secure Cloud Computing

Blog Feed Post

Preventive Security Through Behavior Modification – Part 3

Logs used in forensics have several distinct advantages

– a $100 billion solution

Gorka Sadowski, CISSP, Principal Solution Architect, LogLogic

In part 3 - (see part 1 and part 2 here) - let’s review why logs are such a popular and powerful tool when performing forensics, and how to insure that investigators are working from a clean stream of data.

Logs used in forensics have several distinct advantages.

First, logs can be used not only to solve the IT crime, but also as evidence in a court of law, provided that they have been properly managed.

Second, logs are widely available. Logs have been around for the past 25 years and today all electronic equipment is capable of generating logs.

Third, best practices for log management are mature, all system administrator manuals have a section on logs, and most of the compliance mandates ask for proper log management (SOX, PCI, etc.).

Fourth, log management tools and solutions are now capable of automating the processing and management of logs, which facilitates forensics and the admissibility of logs as evidence.

Let’s look at some of the critical success factors necessary in your log management solution which will help you leverage the maximum benefit from logs.

Collect all your logs. It is important to collect and manage all of the logs to get a complete and accurate picture of what happened. You never know which log you will need in the future, so when in doubt, collect it and properly manage it.

Ensure log integrity. To guarantee that you stay on the right track during your forensics, and that your logs are admitted and accepted as evidence, you need to ensure the integrity of the logs.  In fact, you need to ensure two kinds of integrity: integrity of each log (to demonstrate that no log has been tampered with) and integrity of the log sequence (to demonstrate that no log has been added and/or no log has been deleted).

Store logs efficiently. Now that you are collecting and managing all of your logs, you will realize that they represent a huge amount of data that needs to be stored. This means that you need to be efficient in how you store your logs. Look into compression mechanisms, use of external storage devices and other tricks to maximize your storage space and minimize costs.

Provide for lightning fast and intuitive search capabilities. When you are performing forensics, you are essentially doing investigative work, or looking for a needle in the haystack.  Make sure that your tool provides you with an intuitive way to perform these searches, and that you get near-instantaneous results.

If you use a tool that respects these basic critical success factors, you will be in a good position to perform proper digital forensics, catch the bad guys and obtain evidence to prosecute them successfully.

Next time we’ll see that Log Management can be an instrument of change in people’s perception and is a powerful tool for behavior modification.

Read the original blog entry...

More Stories By Bill Roth

Bill Roth is a Silicon Valley veteran with over 20 years in the industry. He has played numerous product marketing, product management and engineering roles at companies like BEA, Sun, Morgan Stanley, and EBay Enterprise. He was recently named one of the World's 30 Most Influential Cloud Bloggers.