Cybersecurity
Cyber Experts Say You Should Use These Best Practices for Event Logging
Today's businesses are no stranger to the word cybersecurity. They are facing a growing wave of cyberattacks. These come from ransomware to sophisticated phishing schemes.
Today's businesses face a steady stream of cyberattacks, from ransomware to sophisticated phishing schemes. A strong cybersecurity strategy is essential, and one crucial component that many business owners overlook is event logging.
The "cyber experts" in this article's title are real. In August 2024, the Australian Signals Directorate's Australian Cyber Security Centre published Best Practices for Event Logging and Threat Detection together with CISA, the FBI, the NSA, and cybersecurity agencies from several other countries. The guidance sets a baseline for logging that helps organizations detect attacks, including the "living off the land" techniques in which attackers use built-in system tools to blend in with normal activity. As your managed IT service provider, Cyber One Solutions can help you put its recommendations into practice.
What is Event Logging?
Event logging is the practice of recording security-relevant events that happen within your IT systems. An event can be many different things, such as login attempts, file access, software installs, network traffic, denial of access, system changes, and many others.
Each logged event carries a time stamp and details about what happened. Together, those records provide a picture of what is going on in your IT environment, and it is through that ongoing picture that you can detect and respond to threats promptly.
Why does this matter? You can detect suspicious activity by monitoring user behavior and system events. You can respond quickly to incidents because you have a clear record of what happened. And you can meet rules that require activity monitoring: the FTC Safeguards Rule requires covered financial institutions to monitor and log the activity of authorized users, and the HIPAA Security Rule requires audit controls that record and examine activity in systems containing electronic protected health information.
Best Practices to Use Event Logging Effectively.
The joint guidance organizes logging around four key factors: an enterprise-approved event logging policy, centralized event log access and correlation, secure storage and event log integrity, and a detection strategy for relevant threats. The practices below follow that structure and work whether you are just starting out or improving an existing setup.
Start With a Written Logging Policy.
The guidance recommends an approved logging policy that spells out which events to log, which logging tools to use, how logs will be monitored, how long they will be kept, and when to reassess what is worth collecting. A policy keeps logging consistent across every system instead of depending on each device's defaults. If a service provider runs part of your environment, the policy should also cover who is responsible for which logs.
Log What Matters Most.
You do not need to record every digital footstep at full detail. Logging every single action on your network can create a mountain of data that is hard to sift through and expensive to store. Focus first on the events and systems that reveal security breaches and compliance risks.
The guidance gives a prioritized list of log sources, starting with critical systems and data, internet-facing services and remote access, identity and domain management servers, and edge devices such as firewalls. For most small and mid-size businesses, the most important events include sign-ins and sign-outs (including failed attempts, password changes, and new accounts), access to sensitive data, administrative actions, and system changes such as software installations and configuration updates.
Event logging is much more manageable when you start with the most critical areas and expand from there.
Use Consistent, Accurate Time Stamps.
Logs from different systems are only useful together if their clocks agree. The guidance recommends synchronizing every system to a trusted time source and using one consistent time format, with Coordinated Universal Time (UTC) as the preferred standard. When an investigator needs to follow an attacker from a firewall to a server to a mailbox, consistent time stamps make that possible.
Centralize Your Logs.
Imagine trying to solve a puzzle with pieces scattered across different rooms. That is what happens when every device keeps its own logs. Forwarding logs to a central, secured location, and from there into a Security Information and Event Management (SIEM) or extended detection and response (XDR) tool, solves that problem. Many network devices have little local storage and overwrite old entries, so central collection also keeps evidence from disappearing.
Central logs make it easier to connect suspicious activity across different systems, respond faster because the evidence is in one place, and see your network as a whole.
Protect the Integrity of Your Logs.
Attackers often try to cover their tracks by deleting or altering logs. That is why the guidance calls for secure storage and event log integrity.
Encrypt logs in transit and at rest, and use cryptographic verification so changes can be detected. Store logs in a location attackers cannot easily reach, such as a separate, access-restricted logging platform or write-once storage that prevents changes and deletion. Limit who can view, change, or delete logs to a small group of trusted personnel.
Protected logs provide an accurate record of events even if a breach occurs.
Establish Log Retention Policies.
Keeping logs forever is not practical, but deleting them too soon is risky. The guidance notes that default retention periods are often insufficient and that it can take up to 18 months to discover some incidents, so retention should be based on risk.
When setting retention, consider your compliance requirements, how far back you would need to look to investigate an incident, and your storage capacity. Keeping recent logs in fast, searchable storage and older logs in lower-cost archive storage helps you strike the right balance.
Check Logs Regularly With a Detection Strategy.
Event logging is only as good as your ability to use it. Do not set and forget your logs. Automated analysis should flag anomalies, and people should review what it finds.
Set up automated alerts for critical events, such as repeated failed sign-ins, new administrator accounts, or logs being cleared. Perform periodic reviews to look for patterns that might show a threat. And use your SIEM or detection platform to correlate events across systems, which is how quieter attacks, including living off the land techniques, are uncovered.
Need Help with Event Logging Solutions?
As a managed IT service provider, Cyber One Solutions can help you build a logging policy, centralize and protect your logs, and connect them to monitoring through our managed security services. Give us a call or email to schedule a chat.