Wednesday, April 9, 2014

Audit Logs the Important Sauce for a Secure Organization

In a recent audit I found that audit logs were not being archived, the team was puzzled on why I was insistence on audit logs. 
Here are my thoughts on the importance of enabling the Audit logs for the various targets in your digital ecosystem, we need the audit logs for your servers, end point devices, applications, databases, network devices, security  tools in your digital ecosystem.
Many administrators disable the audit log since because they do not understand that the audit log is one of simplest & effective tools available to keep your environment safe.
The audit log tracks every action undertaken in your digital ecosystem by users and unwelcome visitors (read potential hackers), the audit log records the duration of time that an user was logged in, which files were opened, what was changed and if required even the keyboard activity.
To run a secure organization we need to constantly assess our vulnerability and the audit log is the key to  collecting data in the digital environment to be able to constantly monitor and proactively defend.
Audit Log is used to automatically track every action undertaken by users on a network. It can record what time a user logged on, which files they opened, what they changed and even which key strokes they used.
It can be used as proof if an employee is not using the system as they are supposed to.
 The Audit Log is Like a Rear View Mirror –  You need to know what is behind you! 

It is also very handy for a team to understand how a problem happened by accident - after all people make mistakes but it is great to know how it happened and what needs to be done to fix the problem and to avoid making the same mistake again. Audit logs (in our experience) can be a very useful to gain an insight of what is really happening in your digital ecosystem. 

If you are a large enterprise you could merge your logs and use analytic tools to get a granular view of what is happening in your network, devices and applications.  This could help your company in strengthening its defenses and also optimize on usage of resources.

No comments:

Post a Comment