Once upon a time, I was retained to create a comprehensive PCI DSS-focused log review policies, procedures and practices for a large company. They are focused on PCI DSS compliance, but based on generally useful log review practices that can be utilized by everybody and with any regulation or without any compliance flavor at all. The practices can be implemented with commercial log management or SIEM tools, open source log analysis tools or manually. As you well know, tools alone don’t make anybody compliant!
This is the FINAL, 18th post in the long, long series (part 1, part 2, part 3 – all parts). A few tips on how you can use it in your organization can be found in Part 1. You can also retain me to customize or adapt it to your needs.
And so we end our Complete PCI DSS Log Review Procedures. Please start reading from Part 1 – at this stage we are deep in the details and these sections might seem out of context without reading earlier parts:
References
The following references are useful for PCI DSS log review program and log management in general:
SANS CAG/CSC
“Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines”
http://www.sans.org/critical-security-controls/
Specifically, the relevant control on audit logs is shown below:
“Critical Control 6: Maintenance, Monitoring, and Analysis of Audit Logs”
NIST 800-92 Logging Guide
“Guide to Computer Security Log Management: Recommendations of the National Institute of Standards and Technology by Karen Kent and Murugiah Souppaya”
http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf
NIST 800-66 HIPAA Guide
“An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule ”
http://csrc.nist.gov/publications/nistpubs/800-66-Rev1/SP-800-66-Revision1.pdf
Appendix A Recommended Logbook Format
Logbook entry:
1. Date/time/time zone this logbook entry was started
2. Name and role of the person starting the logbook entry
3. Reason it is started: log exception (copied from log aggregation tool or from the original log file), make sure that the entire log is copied, especially its time stamp (which is likely to be different from the time of this record) and system from which it came from (what/when/where, etc)
4. Detailed on why the log is not routine and why this analysis is undertaken
5. Information about the system that produced the exception log record or the one this log exception is about
a. Hostname
b. OS
c. Application name
d. IP address(s)
e. Location
f. Ownership (if known)
g. System criticality (if defined and applicable)
h. Under patch management, change management, FIM, etc
6. Information about the user whose activity produced the log (if applicable)
7. Investigation procedure followed, tools used, screenshots, etc
8. Investigative actions taken
9. People contacted in the course of the log analysis
10. Impact determine during the course of the analysis
11. Recommendations for actions, mitigations (if needed)
Follow PCI_Log_Review to see all posts.
Possibly related posts:
- Incident Log Review Checklist
- All posts tagged PCI_Log_Review
