Information Gathering -> Logging: Centralized system logging
Risk and Opportunity
Risk: Local stored system logs can be unauthorized manipulated by attackers or might be corrupt after an incident. In addition, it is hard to perform a aggregation of logs.
Opportunity: By using centralized logging logs are protected against unauthorized modification.
- rsyslog, Link, Tags: tool logging
- logstash, Link, Tags: tool logging
Usefulness and Requirements of this Activity
Required knowledge: Very Low (one discipline)
Required time: Very Low
Required resources (systems): Very Low
OWASP SAMM VERSION 2
- not explicitly covered by ISO 27001 - too specific