To remain competitive in the digital age, organizations frequently introduce new hardware devices and software installations to their IT environments. The problem is that these assets might suffer from vulnerabilities that attackers could misuse, if unpatched, to change a device’s configuration or make unauthorized modifications to some of the organization’s important files.
Either of these scenarios could help threat actors to establish an initial foothold on the network, access which they could then leverage to move laterally to other systems, exfiltrate important data, and overall cause additional harm.
Companies can leverage security configuration management (SCM) and file integrity monitoring (FIM) to address some of these risks and to reduce their attack surface. However, organizations cannot hope to adequately secure their infrastructure unless they have an accurate idea of what is happening in their environment.
To achieve that level of visibility, they must turn to log management.
Understanding the Basics
Here’s a high-level overview of how logs work. Each event in a network generates data, and that information makes its way into the logs, records that are produced by operating systems, applications, and other devices. Logs are crucial to security visibility. If organizations fail to collect, store, and analyze those records, they could open themselves to digital attacks.
The Center for Internet Security (CIS) agrees with this sentiment. That explains why the non-profit entity included log management in Version 8 of its Critical Security Controls (CSC). It also includes why CIS included three of the 12 Safeguards associated with CIS Control 8: Audit Log Management in its first Implementation Group (IG1), a means of prioritization by which organizations can achieve basic cyber hygiene.
Organizations put their threat detection efforts at risk if they don’t invest in log management. As an example, here CIS puts the threat of insufficient log management into context:
Log collection and analysis is critical for an enterprise’s ability to detect malicious activity quickly. Sometimes audit records are the only evidence of a successful attack. Attackers know that many enterprises keep audit logs for compliance purposes, but rarely analyze them. Attackers use this knowledge to hide their location, malicious software, and activities on victim machines. Due to poor or nonexistent log analysis processes, attackers sometimes control victim machines for months or years without anyone in the target enterprise knowing.
Log management is also critical to incident response. Nowadays, digital attackers can use the complexity of organizations’ network environments to move laterally to different assets so that they can exfiltrate sensitive information. Such activity makes it difficult for security teams to figure out exactly what happened in a security incident and determine its full scope without the ability to analyze complete log records.
The Log Management Process
There are five elements of a complete log management process. They are as follows:
1. Collection
Organizations need to collect logs over encrypted channels. Their log management solution should come equipped with multiple means to collect logs, but it should recommend the most reliable means of doing so. In general, organizations should use agent-based collection whenever possible, as this method is generally more secure and reliable than its agentless counterpart.
2. Storage
Once they have collected them, organizations need to preserve, compress, encrypt, store, and archive their logs. Companies can look for additional functionality in their log management solution such as the ability to specify where they can store their logs geographically. This type of feature can help meet their compliance requirements and ensure scalability.
3. Search
Organizations need to confirm that they can find their logs once they’ve stored them, so they should index their records in a way where they are discoverable via plaintext, REGEX, and API queries. A comprehensive log management solution should enable companies to optimize each log search with filters and classification tags. It should also allow them to view raw logs, conduct broad and detailed queries, and compare multiple queries at once.
4. Correlation
Organizations need to create rules that they can use to detect interesting events and perform automated actions. Of course, most events don’t occur on a single host in a single log. For that reason, companies should look for a log management solution that lets them create correlation rules according to the unique threats and requirements their environments face. They should also seek out a tool that allows them to import other data sources such as vulnerability scans and asset inventories.
5. Output
Finally, companies need to be able to distribute log information to different users and groups using dashboards, reports, and email. Their log management solution should facilitate that exchange of data with other systems and the security team.
How Tripwire Log Center Can Help
Tripwire Log Center takes all five of those parameters to heart. Among other things, it enables companies to create customized log rules, collect and store all data, customize dashboards according to noteworthy events on the network, and reduce noise by filtering out data.
To learn more about Tripwire’s log management solution, click here.
Log management is just one of five security controls with which organizations should concern themselves when purchasing a new security solution. To learn more, download this whitepaper.
