稽核紀錄(Log)的管理，對於資訊管理者而言通常是很嚴峻的工作，各種安全軟硬體產品，都各有其不同的Log紀錄，預設監測的事件紀錄是否符合組織安全目標的要求，對於監測的紀錄何時檢視，誰來檢視這些紀錄，是否包含網路管理員、系統管理員、資料庫管理員都要對不同的紀錄進行檢視，多如牛毛的紀錄對於預防資安事件是否有幫助，如何分析這些Log紀錄，種種的問題都考驗管理者如何妥善的管理這些Log紀錄，參考NIST SP 800-92 Guide to Computer Security Log Management ，此份指引將Log管理區分成幾個方面，首先，應確認組織中有那些防禦性偵測性的安全機制(Security Software)，了解每種系統的Log紀錄，其次，選出組織中哪些伺服器之作業系統(Operation System)需要監控，最後，確認組織中哪些應用系統(Application System)需要監控，如業務類或是支援類有不同的監控要求。確認的虛監控的標的後，選擇需要紀錄的事件，可參考Microsoft在事件檢視器中有定義一些需蒐集紀錄的事件。Log管理的建置策略可參考(Establish Logging Policies)章節。
NIST SP 800-92 Guide to Computer Security Log Management
摘要
Security Software(安全性系統)
- Antimalware Software (防毒軟體)
- Intrusion Detection and Intrusion Prevention Systems (入侵偵測系統)
- Remote Access Software(遠端存取軟體)
- Web Proxies(網站代理伺服器)
- Vulnerability Management Software. (弱點管理軟體)
- Authentication Servers (認證伺服器)
- Routers (路由器)
- Firewalls (防火牆)
- Network Quarantine Servers (網路監控伺服器)
Operating Systems(作業系統)
- System Events (系統事件) shutting down the system or starting a service.(關機或重啟)、failed events and the most significant successful events are logged,(失敗事件)、CIA的考量(機密性、'完整性、可用性)
- Audit Records Microsoft 事件檢視器稽核原則建議
Applications(應用系統)
- Client requests and server responses (需求與回應)
- Account information(帳號監控
- Usage information(資料存取監控)
- Significant operational actions(重要的作業行為)
Usefulness of Logs.
The Need for Log Management
The Challenges in Log Management
Log Generation and Storage
Many Log Sources(log來源多樣)
Inconsistent Log Content (不一致的內容)
Inconsistent Timestamps(不一致的時間戳記)
Inconsistent Log Formats(不一致的格式)
Log Protection
Log Analysis
Log Management Infrastructure
Architecture
Log Generation
Log Analysis and Storage
Log Monitoring.
Establish Logging Policies(建置log管理的策略)
Log generation (要監測哪些log)
- Which types of hosts must or should perform logging
- Which host components must or should perform logging (e.g., OS, service, application)
- Which types of events each component must or should log (e.g., security events, network connections, authentication attempts)
- Which data characteristics must or should be logged for each type of event (e.g., username and source IP address for authentication attempts)
- How frequently each type of event must or should be logged (e.g., every occurrence, once for all instances in x minutes, once for every x instances, every instance after x instances)
- Which types of hosts must or should transfer logs to a log management infrastructure
- Which types of entries and data characteristics must or should be transferred from individual hosts to a log management infrastructure
- How log data must or should be transferred (e.g., which protocols are permissible), including out-of-band methods where appropriate (e.g., for standalone systems)
- How frequently log data should be transferred from individual hosts to a log management infrastructure (e.g., real-time, every 5 minutes, every hour)
- How the confidentiality, integrity, and availability of each type of log data must or should be protected while in transit, including whether a separate logging network should be used
Log storage and disposal(Log的儲存與輪轉)
- How often logs should be rotated
- How the confidentiality, integrity, and availability of each type of log data must or should be protected while in storage (at both the system level and the infrastructure level)
- How long each type of log data must or should be preserved (at both the system level and the infrastructure level)46
- How unneeded log data must or should be disposed of (at both the system level and the infrastructure level)
- How much log storage space must or should be available (at both the system level and the infrastructure level)
- How log preservation requests, such as a legal requirement to prevent the alteration and destruction of particular log records, must be handled (e.g., how the impacted logs must be marked, stored, and protected)
Log analysis( Log分析)
- How often each type of log data must or should be analyzed (at both the system level and the infrastructure level)
- Who must or should be able to access the log data (at both the system level and the infrastructure level), and how such accesses should be logged
- What must or should be done when suspicious activity or an anomaly is identified
- How the confidentiality, integrity, and availability of the results of log analysis (e.g., alerts, reports) must or should be protected while in storage (at both the system level and the infrastructure level) and in transit
- How inadvertent disclosures of sensitive information recorded in logs, such as passwords or the contents of e-mails, should be handled.
市面常用的Log管理工具
https://www.solarwinds.com/kiwi-syslog-server如何調整Windows作業系統最佳稽核原則?
沒有留言:
張貼留言