Fork me on GitHub

Information Gathering -> Logging: Centralized system logging

Risk and Opportunity

Risk: Local stored system logs can be unauthorized manipulated by attackers or might be corrupt after an incident. In addition, it is hard to perform a aggregation of logs.
Opportunity: By using centralized logging logs are protected against unauthorized modification.

Exploit details

Usefullness: Low
Required knowledge: Very Low (one discipline)
Required time: Very Low
Required resources (systems): Very Low

Additional Information

Implementation hints: rsyslog, Logstash
OWASP SAMM 2 Mapping: o-incident-management|A|1