CYB/205
Audit Logs
CYB/205
Information Contained In Audit Logs and Their Value
Knowing who, what, when and how on a computer network is paramount to its security.
Setting up an audit log / trail allows a network/system administrator to essentially virtually
follow a user through their digital stroll through the network. Here are a some of the things
that need to be logged.
User IDs (Walsh, 2018)
Date and time records for when Users log on and off the system (Walsh, 2018)
Terminal ID (Walsh, 2018)
Access to systems, applications, and data – whether successful or not (Walsh,
2018)
Files accessed (Walsh, 2018)
Networks access (Walsh, 2018)
System configuration changes (Walsh, 2018)
System utility usage (Walsh, 2018)
Exceptions (Walsh, 2018)
Security-related events such as triggered alarms (Walsh, 2018)
Protection system notifications (i.e. intrusion detection or anti-malware
notifications) (Walsh, 2018)
This audit logged information has tremendous value for security administrators,
investigators and researchers. When conducting a forensic digital audit having logs that pin-
point a users exact location within the network, the time and what files were accessed
provides for a very robust security posture. This way, in the event a breach happens the
holes that were exploited can be identified and plugged.
