[Autogenerated] requirement.
10 men all about logging on monitoring.
So we've we've really moved away now from preventative or protective controls
and moving into starting to having some detective controls.
Only because the idea of requirement 10 is that you
confined bad things that are happening.
Yes, in real time or very nearly.
Yeah, it's no on.
This is what people keep.
A lot of people say to me,
you but requirement tenets only really useful if we get breached,
isn't it?
That's the only time we need our logs.
Maybe you can make a breached less severe right by catching it sooner.
Right?
Or or maybe you can sort of catch it in progress and
prevent something bad from happening.
Uh, you know,
if you go look at any of the statistics about actual security
incidents like from the Verizon data breaches,
uh, investigation report right when they when they look at the time scale,
right.
The order of magnitude of time for the attacker to make first
contact for the attacker to start XSLT rating cardholder data for
the organization to detect what has happened,
right, That's that's,
like seconds or minutes and then minutes or hours and then weeks or months.
Uh, because they're not really looking at their logs.
Right?
Or they're they're doing something very perfunctory and very sort of check box.
Uh, that doesn't That doesn't tell them anything.
Yeah, and this is one thing that I struggle to describe to lots of people.
Really.
DSS is also about detection.
It's about alright.
It's only just one is one requirement out of 12, right?
But it's about you.
You.
There's something not right in your network or something,
not right in your systems.
You've got the opportunity to spot it.
E from Verizon.
You know, it is weeks or months in that database report.
It's generally averages in, like, 100 days or something like that.
A lot.
I don't know if you noticed.
Recently there was a large compromise of the European airline,
Yes, and that the detection papers 15 days,
and I was thinking that was pretty good.
It's pretty good on all of the Internet went into meltdown,
saying, Well, how come it took 15 days and I'm thinking,
Wow, I thought 15 days was good,
but only thinks the internet minutes to forget about what happened before.
So logging and monitoring We'll talk about that first,
and then we'll talk about time because time waits for no one.
Right.
So you have to buy something to do this properly now, don't you?
E I don't think you could do it without without at least some some tools, right?
Some of them are open source, but they take a little bit more sort of effort.
But yeah, the idea that you could just, like,
task an intern to, like, watch the logline scroll by is ridiculous,
right?
S.
Oh, yeah.
You need something to collect all that log data to do some analytics, right?
To filter out all of the sort of boring stuff and bring
to the surface the interesting things, right?
So it's a que se you walk on site,
you You're going to do an assessment of requirement
that What are you looking for?
Eso The two pieces are Show me what data you are collecting in the first place,
right?
All the stuff in 10.2 in 10.3.
Show me how you're doing this.
Okay?
How are you?
How are you logging this at the appropriate layer?
Right?
Right on.
In some cases, that's gonna be the operating system logs.
Right?
Uh, tell me about logging failures at the operating system.
Right.
If if an administrator user account fails,
you know Loggins 10 times in a row at three.
In the morning.
You want to know that, right?
And sometimes is that at an application layer, right?
And if they're developing their own application,
they have to develop its capability to log these events.
So, what are you looking at?
A necessity.
You're looking at the logs you actually trying to
create you trying to You're saying, looking in the wrong password.
You know,
I generally don't force a client to create a
situation just to produce a log event.
I mean, maybe something relatively low key, like flub the password.
And then let's see the log, you know, is not is not a big ask,
but, you know, go delete a system level object.
URL IT.
Go drop a table in your database, just like yeah,
that's that's maybe a bridge too far.
But I do want to see yes, some log events that show these these criteria right?
Described in 10.2 in 10.3.
Um, So, yeah,
go find those for us or go give us some sample of data and then
we'll look for them in that in that spread.