Auditing and Logging Vulnerabilities

From Guidance Share

Revision as of 02:01, 30 October 2006; Admin (Talk | contribs)
(diff) ←Older revision | Current revision | Newer revision→ (diff)
Jump to: navigation, search



Auditing and logging should be used to help detect suspicious activity such as footprinting or possible password cracking attempts before an exploit actually occurs. Itcan also help deal with the threat of repudiation. It is much harder for a user to deny performing an operation if a series of synchronized log entries on multiple servers indicate that the user performed that transaction.


  • User Denies Performing an Operation
  • Attackers Exploit an Application Without Leaving a Trace
  • Attackers Cover Their Tracks


  • Anonymous access enabled


  • Repudiation Attack


Countermeasures to prevent Auditing and Logging attacks include:

  • Disable anonymous access and authenticate every principle
Personal tools