1 AUDIT LOGGING/LOG MANAGEMENT KATHLEEN A MULLIN, MBA, CIA, CISA, CISSP, ISA, CISM, CRISC, CGEIT DIRECTOR OF IT SECURITY/CISO HEALTHPLAN SERVICES (HPS) AHIA 31 st Annual Conference August 26-29, 2012 Philadelphia PA www.ahia.org
Key Points 2 When is log information important and what Audit needs to focus on Where to look for additional information to interpret log data What actions should be taken by which role within the organization What are the appropriate actions based on the log data What is appropriate p without a logging g tool what organizations should evaluate when looking for a logging tool
3 When is log information important?
What to focus on 4 Information Overload Business Impact Analysis Risk Requirements Operational Business Regulatory
Appropriate p deployments 5 Project Approach Platform Business Geographic Stability Resource
What to Log 6 Syslog Events Access Logs Windows Log Events IDS / IPS Logs Database Logs Firewall Logs System Logs Network Flows Error Logs Security Logs Application Logs Backup Logs Patch Logs Anti-Malware Logs Policy Change Logs Integrity Logs Change Logs Engineering g Systems
Log Reporting What to focus on 7 SANS Top 5 Log Reports Attempts to Gain Access through Existing Accounts Failed File or Resource Access Attempts Unauthorized Changes to Users, Groups and Services Systems Most Vulnerable to Attack Suspicious or Unauthorized Network Traffic Patterns
Where to look for additional if information to interpret it t log dt data 8
Where to look for additional if information to interpret it t log dt data 9 Vendors Search Engines Additional i Resources
What actions should be taken by which role within the organization 10
What actions should be taken by which role within the organization 11 IT Information Security Incident Response Team Business Process Owner Risk Compliance Audit Finance Legal Human Resources Management
What actions should be taken by which role within the organization 12
What actions should be taken by which role within the organization 13
What actions should be taken by which role within the organization 14
What are the appropriate actions based on the log data 15 RISK Operational requirements Contractual requirements Insurance requirements Change Management RISK Incident cde Response se Plan Disaster Recovery Plans Business Continuity Plans
What are the appropriate actions based on the log data 16 Environmental Norm Critical Error Warning
What to do without a logging tool and what to look for in a logging tool 17
What to do without a logging g tool 18 RISK Based Operational requirements Contractual requirements Insurance requirements Change Management
What to look for in a logging g tool 19 Collect, Index- Correlate Alert Store Report Scalability Tuning Analytics Segregation of duties
What to look for in a logging g tool 20 Integration with work order systems File Integrity Monitoring Security Monitoring and Reporting Fraud Detection Data loss detection Compliance
Summary 21 When is log information important and what Audit needs to focus on Where to look for additional information to interpret log data What actions should be taken by which role within the organization What are the appropriate actions based on the log data What is appropriate without a logging tool what organizations should evaluate when looking for a logging tool
Additional Resources - ISACA 22 ISACA http://www.isaca.org/ CoBIT 4.1 http://www.isaca.org/knowledge-center/cobit/pages/overview.aspx CoBIT 5.0 http://www.isaca.org/cobit/pages/info-sec.aspx /COBIT/P / The Risk IT Framework http://www.isaca.org/knowledge-center/risk-it-it-risk- Management/Pages/Risk-IT1.aspx
Additional Resources - NIST 23 NIST http://csrc.nist.gov/ Guide to Computer Security Log Management http://csrc.nist.gov/publications/nistpubs/800-92/sp800-92.pdf pdf Recommended Security Controls for Federal Information Systems and Organizations http://csrc.nist.gov/publications/nistpubs/800-53-rev3/sp800-53- rev3-final.pdf
Additional Resources e-discovery 24 Discovery Resources http://www.discoveryresources.org/ State by State Summary Report of E-Discovery Efforts http://www discoveryresources org/library/case law and http://www.discoveryresources.org/library/case-law-andrules/state-rules/annotated-list-of-state-rules-of-civil-procedure/
Additional Resources - Microsoft 25 Microsoft http://www.ultimatewindowssecurity.com/default.aspx http://www.eventid.net/ p// / http://technet.microsoft.com/en-us/default.aspx http://support.microsoft.com/
Additional Resources Best Practices 26 SANS Critical Control 14: Maintenance, Monitoring, and Analysis of Security Audit Logs http://www.sans.org/critical-securitycontrols/control.php?id=14 Top 5 Essential Log Reports http://www.sans.org/security-resources/top5-logreports.pdf The Unified Compliance Framework (UCF) http://www.unifiedcompliance.com/
Additional Resources 27 PCI Data Security Standards https://www.pcisecuritystandards.org/ https://www.pcisecuritystandards.org/security p y_ standards/documents.php Kerberos http://www.rfc-editor.org/rfc/rfc1510.txt Microsoft PowerShell for Windows Server 2003 http://www.microsoft.com/downloads/details.aspx?familyid=10ee29af-7c3a- 4057-8367-C9C1DAB6E2BF&displaylang=en
28 Questions??
Thank-you 29 kmullin@healthplan.com
Save the Date: August 25-28, 2013 32 nd Annual Conference Chicago, IL 30