Auditing and Logging

From Guidance Share

Jump to: navigation, search

Contents

Description

Auditing and logging should be used to help detect suspicious activity such as footprinting or possible password cracking attempts before an exploit actually occurs. Itcan also help deal with the threat of repudiation. It is much harder for a user to deny performing an operation if a series of synchronized log entries on multiple servers indicate that the user performed that transaction.


Impact

  • User Denies Performing an Operation
  • Attackers Exploit an Application Without Leaving a Trace
  • Attackers Cover Their Tracks


Vulnerabilities

  • Anonymous access enabled


Attacks

  • Repudiation Attack


Countermeasures

Countermeasures to prevent Auditing and Logging attacks include:

  • Disable anonymous access and authenticate every principle


Done

Personal tools