Logging data from impacted assets cannot be inspected when investigating a cybersecurity event

Logging data from impacted assets cannot be inspected when investigating a cybersecurity event

Context and Guidance: Logging data that is collected from your assets (such as networks, systems, and applications) can serve as a key source of information to support the early detection of a cybersecurity threat.

Ensuring that logging data is available when investigating a cybersecurity event is also important. When assets are impacted, and logging data generated by those assets is unavailable, you have a limited ability to respond.

Example activities that indicate this Anti-Pattern is Present include:

• Logging data is stored in a cloud (Internet) based repository, and logging data in this repository cannot be inspected during a Distributed Denial of Service (DDOS) attack, or;
• Logging data cannot be centrally inspected by your security monitoring solution as it is stored in a segregated network inaccessible during an incident, or;
• Logging data cannot be inspected given security logging requirements were not established by the function, and therefore the logging data is not fit-for-purpose or is unintelligible.