Tag Archives: compliance

Let’s Talk About Audit Logs

Posted on by
Reply

CIS Control 8: Audit Log Management

Data is at the core of every business in today’s digital age. Protecting that data is of paramount importance. For this reason, the Center for Internet Security (CIS) developed the CIS Controls to provide a comprehensive framework for cybersecurity best practices.

One of these controls, CIS Control 8, focuses specifically on audit log management. This control aims to ensure that all events and security-related information are recorded and retained in an audit log for a defined period.

This article will explore the importance of audit log management as a fundamental component of any organization’s security posture. We will examine the CIS Control 8 safeguard requirements and industry-standard best practices for audit log management.

By following the procedures outlined in this article, organizations can improve their security posture, meet all CIS CSC version 8 safeguards, and ensure compliance with industry standards.

Why audit log management is essential

Audit log management is essential for every organization that wants to ensure its data security. The reason is simple: audit logs provide a comprehensive record of all events and security-related information that occurs within a system. This information is critical for incident response, threat detection, and compliance monitoring. Without audit logs, organizations would have no way of knowing who accessed what information, when or how the incident happened, or whether unauthorized users or suspicious activity occurred.

In addition to aiding in incident response and threat detection, audit log management also supports compliance with industry regulations and guidelines. Many compliance requirements mandate that organizations maintain a record of all activity that occurs on their systems. Failing to comply with these requirements can result in significant legal and financial penalties. Therefore, organizations prioritizing data security must take audit log management seriously and implement practices that meet their data security needs and safeguard requirements.

Best practices for audit log management

Audit log management is critical to an organization’s data security efforts. To ensure that your audit log management practices meet the CIS CSC version 8 guidelines and safeguard requirements, consider implementing the following best practices:

1. Define the audit log requirements: Assess the audit log requirements for your organization based on industry regulations, guidelines, and best practices. Define the data to be logged, audit events, and retention periods.

2. Establish audit policies and procedures: Develop audit policies and procedures that align with your organization’s requirements. Ensure these policies and procedures are implemented consistently across all systems and devices.

3. Secure audit logs: Audit logs should be collected, stored, and protected securely to prevent unauthorized access or tampering. Only authorized personnel should have access to audit logs.

4. Monitor and review audit logs: Regularly monitor and review audit logs for anomalies, suspicious activity, and security violations. This includes monitoring for unauthorized access attempts, changes to access rights, and software installations.

5. Configure audit logging settings: Ensure audit logs capture essential system information and user activity information. Configure audit logging settings to generate records of critical security controls, including attempts to gain unauthorized access or make unauthorized changes to the network.

6. Generate alerts: Configure the system to generate real-time alerts for critical events. This includes alerts for security violations, unauthorized access attempts, changes to access rights, and software installations.

7. Regularly test audit log management controls: Ensure audit log management controls are consistently implemented and reviewed. Conduct regular testing to ensure they are effective and meet your organization’s audit log requirements.

Organizations can establish a strong framework for incident response, threat detection, and compliance monitoring by implementing these best practices for audit log management. This will help safeguard against unauthorized access, malicious activity, and other security breaches, prevent legal and financial penalties, and maintain trust levels with clients and partners.

Audit log management policies

To establish audit log management policies that meet CIS CSC version 8 guidelines and safeguard requirements, organizations should follow the following sample policy:

1. Purpose: The purpose of this policy is to establish the principles for collecting, monitoring, and auditing all system and user activity logs to ensure compliance with industry regulations, guidelines, and best practices.

2. Scope: This policy applies to all employees, contractors, equipment, and facilities within the organization, including all workstations, servers, and network devices used in processing or storing sensitive or confidential information.

3. Policy:

– All computer systems and devices must generate audit logs that capture specified audit events, including user logins and accesses, system configuration changes, application accesses and modifications, and other system events necessary for detecting security violations, troubleshooting, and compliance monitoring.

– Audit logs must be generated in real-time and stored in a secure, centralized location that is inaccessible to unauthorized users.

– The retention period for audit logs must be at least 90 days, or longer if law or regulation requires.

– Only authorized personnel with appropriate access rights and clearances can view audit logs. Access to audit logs must be audited and reviewed regularly by the Information Security team.

– Audit logs must be reviewed regularly to identify patterns of suspicious activity, security violations, or potential security breaches. Any unauthorized access or security violation detected in the audit logs must be reported immediately to the Information Security team.

– Audit log management controls, and procedures must be tested periodically to ensure effectiveness and compliance with CIS CSC version 8 guidelines and safeguard requirements.

4. Enforcement: Failure to comply with this policy may result in disciplinary action, up to and including termination of employment or contract. All violations must be reported to the Information Security team immediately.

By implementing the above policy, organizations can ensure they meet the audit log management standards set forth by CIS CSC version 8 guidelines and safeguard requirements. This will help organizations prevent unauthorized access, malicious activity, and data breaches, maintain compliance with industry regulations, and protect the integrity and confidentiality of sensitive or confidential information.

Audit log management procedures

Here are the audit log management procedures that establish best practices for performing the work of this control:

I. Initial Setup

– Determine which audit events will be captured in the logs based on industry regulations, guidelines, and best practices.

– Configure all computer systems and devices to capture the specified audit events in the logs.

– Establish a secure, centralized location for storing the logs that is inaccessible to unauthorized users.

II. Ongoing Operations

– Set the logs to generate in real time.

– Monitor the logs regularly to detect security violations, troubleshoot, and monitor compliance.

– Ensure only authorized personnel with appropriate access rights can view the logs.

– Review the logs regularly to identify patterns of suspicious activity, security violations, or potential security breaches.

– Immediately report any unauthorized access or security violation detected in the logs to the Information Security team.

– Retain log data for at least 90 days, or longer if required by law or regulation.

III. Testing and Evaluation

– Test the audit log management controls and procedures periodically.

– Ensure that all testing and evaluation are conducted in compliance with CIS CSC version 8 guidelines and safeguard requirements.

By following these audit log management procedures, organizations can establish best practices for performing the work of this control and ensure that all system and user activities are properly monitored and audited. This will help organizations maintain compliance with industry regulations, prevent unauthorized access, and protect sensitive or confidential information from data breaches.

 

*This article was written with the help of AI tools and Grammarly.

Compliance-Based Infosec Vs Threat-Based Infosec

Posted on by
Reply

In the world of Information Security (infosec), there are two main philosophies: compliance-based infosec and threat-based infosec. Compliance-based infosec means meeting a set of written security standards designed to fulfill some goal such as the requirements of statute law or financial information privacy requirements. Threat-based infosec, on the other hand, means applying information security controls in reaction to (or anticipation of) threats that organizations currently (or soon will) face. 

Compliance-based infosec is generally applied smoothly across the organization. In other words, all the security controls mandated in the security standard must be put in place by the organization, and the relative effectiveness of each control is largely ignored. In contrast, security controls are applied in a hierarchical manner in threat-based infosec. The most effective or greatly needed security controls are applied first according to the threats that are most likely to occur or that will cause the most damage to the organization if they do occur. 

The difference is sort of like the defensive strategy of the Chinese versus that of the Normans in post-conquest England. The Chinese built very long walls that went from one end of their territory to the other. Their goal was to keep out all invaders everywhere. This is a grand idea, but takes a very large amount of resources to implement and maintain. In practice, it takes tons of men and infrastructure and the defensive capabilities at any one place are spread thin. The Normans in England, on the other hand, built strong castles with many layers of defense in strategic locations where the threats were greatest and where it was easiest to support neighboring castles. In practice, there are fewer defenses at any one point, but the places where defenses are implemented are very strong indeed. Both of these strategies have merit, and are really driven by the particular set of circumstances faced by the defender. But which is better for your organization? Let’s look at compliance-based infosec first.

Compliance-based infosec, when implemented correctly, is really the best kind of defense there is. The problem is, the only place I’ve ever seen it really done right is in the military. In military information security, failure to protect private information can lead to death and disaster. Because of this, no expense or inconvenience is spared when protecting this information. Everything is compartmentalized and access is strictly based on need to know. Every system and connection is monitored, and there are people watching your every move. There are rules and checklists for everything and failure to comply is severely punished. In addition, finding better ways to protect information are sought after, and those that come up with valuable ideas are generously rewarded.

This is not the way compliance-base infosec works in the private sector, or even in non-military government agencies. First, statute law is tremendously vague when discussing implementing information security. Laws make broad statements such as “personal health information will be protected from unauthorized access or modification”. Fine. So a group of people get together and write up a body of regulations to further spell out the requirements organizations need to meet to comply with the law. Unfortunately, you are still dealing with pretty broad brush strokes here. To try to get a handle on things, agencies and auditors rely on information security standards and guidelines such as are documented in NIST or ISO. From these, baseline standards and requirements are set down. The problems here are many. First, baseline standards are minimums. They are not saying “it’s best if you do this”, they are saying “you will at least do this”. However, typical organizations, (which generally have very limited infosec budgets), take these baseline standards as goals to be strived for, not starting points. They very rarely meet baseline standards, let alone exceed them. Also, NIST and ISO standards are not very timely. The standards are only updated occasionally, and they are not very useful for countering new and rapidly developing threats. So, unless your organization is really serious about information security and has the money and manpower to make it work, I would say compliance-based infosec is not for you. I know that many organizations (such as health care and financial institutions) are required to meet baseline standards, but remember what happened to Target last year. They were found to be compliant with the PCI DSS, but still had tens of millions of financial records compromised.

Now let’s look at threat-based infosec. To implement a threat-based information security program, the organization first looks at the information assets they need to protect, the threats and vulnerabilities that menace them and the consequences that will ensue if those information assets are actually compromised (basic asset inventory and risk assessment). They then prioritize the risks they face and decide how to implement security controls in the most effective and efficient way to counter those particular risks. That might mean implementing strong egress filtering and log monitoring as opposed to buying the fanciest firewall. Or it might mean doing something simple like ensuring that system admins use separate access credentials for simple network access and administrative access to the system. Whatever controls are applied, they are chosen to solve particular problems, not to meet some broad baseline that is designed to meet generally defined problems. Also, threat-based infosec programs are much better at anticipating and preparing for emerging threats, since reassessments of the security program are made whenever there are significant changes in the system or threat picture.

These are the reasons that I think most of us in non-military organizations should go with threat-based infosec programs. Even those organizations that must meet regulatory requirements can ensure that they are spending the bulk of their infosec money and effort on the effective controls, and are minimizing efforts spent on those controls that don’t directly counter real-world threats. After all, the laws and regulations themselves are pretty vague. What counts in the long run is real information security, not blind compliance with inadequate and antiquated baselines. 

Thanks to John Davis for this post.

Touchdown Task for June: Document Cleanup

Posted on by
2

With the beginning of a new fiscal year on the immediate horizon for many, it reminds us that it’s time to clean up our books and our filing. And by that we mean both our digital and physical files! If you don’t already have a written document retention policy, one needs to be drafted. It should be tailored to your business needs and meet the requirements identified in local, state or federal laws and regulations that apply to your particular industry. 

As a part of your document retention plan, you will establish a document retention schedule of what to keep and for how long. Once you have this identified, it’s time to dive into the files, both paper and electronic, to see what should be properly destructed. 

It is critical that paper documents are either incinerated or shredded. Electronic files must be properly sanitized and purged. Purging can be accomplished a variety of secure erasing tools. A quick Google will turn up several free or low cost solutions. Clearing electronic data is often accomplished by overwriting existing data using software that incorporates a fixed sequence of characters. 
Whatever the processes are that you elect to perform, it is imperative that you stick to the schedule and destroy your documents per your written guidelines in your document retention policy.

Thanks to Teresa West for this post.

MSI Strategies & Tactics Talk Episode 5: Is Compliance-centric Security The Way To Go?

Posted on by
Reply

“Compliance-centric security is bleeding us dry.” – Brent Huston, CEO and Security Evangelist for MSI

Listen in as our tech team discusses compliance-centric security, including:

  • What is compliance-centric security?
  • Why is it a problem?
  • How it creates a “do-the-minimum mentality”
  • What is the alternative to compliance-centric security?

Panelists:

Brent Huston, CEO and Security Evangelist, MicroSolved, Inc.
Adam Hostetler, Network Engineer and Security Analyst
Phil Grimes, Security Analyst
John Davis, Risk Management Engineer
Mary Rose Maguire, Moderator, Marketing Communication Specialist, MicroSolved, Inc.

Click the embedded player to listen. Or click this link to access downloads. Stay safe!

What Helps You with PCI?

Posted on by
Reply

Yesterday, at RSA much press attention was paid to a metric that 41% of all organizations tested needed temporary compensating controls to meet even the minimum security provided by PCI DSS compliance.

This led us to this discussion. If so many organizations need temporary controls to do the minimum, then what controls, in your experience, are the most worthwhile for those struggling to meet PCI?

Please leave a comment and tell us what controls you find most useful, easiest to leverage and worth the investment for PCI compliance.

As always, thanks for reading and we look forward to your input.

Bandwagon Blog: Why Isn’t Compliance & Regulation Working?!?

Posted on by
Reply

Everyone else seems to be blogging about it, so why not a “me too” blog from a different angle?

The main security questions people seem to be asking over the last few days are “Why are data theft and compromise rates souring? I thought that regulations like GLBA, HIPAA, various state laws, PCI DSS and all the other myriad of new rules, guidelines and legislation were going to protect us?”

The answers to these questions are quite complex, but a few common answers might get us a little farther in the discussion. Consider these points of view as you debate amongst yourselves and with your CIO/COO/CEO and Board of Directors in the coming months.

What if compliance becomes another mechanism for “doing the minimum”? The guidance and legal requirements are meant to be minimums. They are the BASELINES for a reason. They are not the end-all, be-all of infosec. Being compliant does not remove all risk of incidents, it merely reduces risk to a level where it should be manageable for an average organization. This absolutely does NOT mean, “have some vendor certify us as compliant and then we are OK.” That’s my problem with compliance driven security – it often leaves people striving for the minimum. But, the minimum security posture is a dangerous security posture in many ways. Since threats constantly evolve, new risks continually emerge and attackers create new methods on an hourly basis – compliance WILL NOT EVER replace vigilance, doing the right thing and driving defense in depth deep into our organizations. Is your organization guilty of seeing compliance as the finish line instead of a mile marker?

Not all vendors “do the right thing”. Vendors (myself included) need to sell products and services to survive. Some (myself NOT included) will do nearly anything to make this happen. They will confuse customers with hype, misleading terminology or just plain lie to sell their wares. For example, there are some well known PCI scanning vendors who never seem to fail their clients. Ask around, they are easy to find. If your organization is interested in doing the minimum and would rather pass an assessment than ensure that your client data is minimally protected, give them a call. They will be happy to send you a passing letter in return for a check. Another example of this would be the “silver bullet technology” vendors that will happily sell their clients the latest whiz-bang appliance or point solution for fixing an existing security need, rather than helping clients find holistic, manageable security solutions that make their organization’s security posture stronger instead of the vendor richer….

Additionally, many compliance issues reinforce old thinking. They focus on perimeter-centric solutions, even as the perimeter crumbles and is destroyed by disruptive technologies. Since regulations, laws and guidance are often much slower to adjust to changes than Internet-time based attackers and techniques, the compliance driven organization NEVER really catches up with the current threats. They spend all of their time, money and resources focused on building security postures and implementing controls that are often already ineffective due to attacker evolutions.

Lastly, I would reinforce  that there are still many organizations out there that just simply will not “do the right thing”. They believe that profit surpasses the need to protect their assets and/or client data. They do not spend resources on real security mechanisms, fail to leverage technologies appropriately, remain careless with policy and processes and do little in terms of security awareness. There are a lot of these organizations around, in nearly every industry. They do security purely by reaction – if they have an incident, they handle that specific issue, then move on. Since consumer apathy is high, they have little to no incentive to change their ways. The only way to enhance the security of these folks is when everyday buyers become less apathetic and veto insecure organizations with their spending. All else will fall short of causing these organizations to change.

So there you have it. A few reasons why regulation is not working. I guess the last one I would leave you with comes from my 16+ years in the industry – good security is hard work. It takes dedication, vigilance, attention to detail, creative AND logical thinking and an ability to come to know the enemy. Good security, far beyond compliance, is just plain tough. It costs money. It is rarely recognized for its value and is always easier to “do the minimum” or nothing at all…