The Top Ten of Audit and Event Log Monitoring

Event Log, Audit Log and Syslog messages have always been a good source of troubleshooting and diagnostic information, but the need to back up audit trail files to a centralized log server is now a mandatory component of many governance standards. Contemporary, SIEM solutions need to be
• flexible enough to cater for all devices, operating systems, platforms, databases and application
• sufficiently scalable to cope with thousands of devices generating millions of events
• intelligent, correlating events and identifying true security incidents only so resources can focus on genuine threats and attacks.

This is an introductory 'Top Ten of Audit Trail and Event Log Monitoring.
1. Security Standards and Corporate Governance Compliance Policies such as PCI DSS and GCSx CoCo require logging mechanisms and the ability to track user activities as they are critical in preventing, detecting, or minimizing the impact of a data compromise. Other policies such as FISMA, Sarbanes Oxley, NERC CIP, ISO 27000 and HIPAA all benefit from a means of centralizing audit log events to identify security incidents.
2. The state of the art in Audit Log Correlation technology provides automated configuration assessment, proactively testing and assessing a server environment against preconfigured, out-of-the-box policies, helping to enable a minimal deployment window. The best solutions leverage industry standards, specifically benchmarks from the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST), and the Defense Information Systems Agency (DISA). These benchmarks include thousands of configuration assessments enabling automatic sustainable policy compliance testing for FISMA.
3. Security standards such as PCI DSS and GCSx CoCo mandate the need to track and monitor all access to network resources and cardholder data Logging mechanisms and the ability to track user activities. The presence of logs in all environments allows thorough tracking and analysis if something does go wrong. Determining the cause of a compromise is very difficult without system activity logs. A central event log analyzer is the best option to use.
4. It is vital that your system for centralizing audit log trails is robust and comprehensive. PCI DSS requires your audit trail history is retained for at least one year with at least 3 months history available for immediate access. The best audit-log tracking software solutions provide real-time indexing of logs with instant keyword search and correlation facilities.
5. While Unix and Linux hosts can forward audit trail and system events using syslog, Windows servers do not have an in-built mechanism for forwarding Windows Events and it is necessary to use an agent to convert Windows Event Logs to syslog. The Windows Events can then be collected centrally using your audit log server. Similarly, applications using Oracle or SQL Server or bespoke or non-standard applications do not use syslog to forward events and it is necessary to use an agent to forward events from these applications. Finally, if you are using an IBM z/OS mainframe or AS/400 system you will need further agent technology to centralize event and audit log messages.
6. Audit trail history must be securely stored in order to prevent retrospective editing or any tampering. The PCI DSS requires that audit trails are promptly backed up to a centralized log server or media that is difficult to alter. The best centralized log server solutions employ file-integrity monitoring for the log backup files so that any modifications can be detected and alerted.
7. Firewalls (Checkpoint, McAfee Sidewinder, Juniper, Netscreen, Cisco ASA, Nokia, Intrusion Protection System (IPS), Intrusion Detection Systems (IDS), routers and RADIUS accounting and authorization services, vulnerability scanning solutions such as Retine eEye, Nessus and other Pen Testing solutions, wireless routers, switches all natively generate syslog messages to report a range of events from the low-level informational logs through to critical events.
8. Syslog messages are defined in RFC 3164 and is officially known as the BSD Syslog Protocol. Syslog messages are sent using UDP on port 514 by default although different ports can be used. Syslog messages use a range of Facility Codes and Severity Codes. The Facility Codes range from 0 to 23 and determine the message type. The Severity Codes range from 0 to 7 as follows:
0 Emergency: system is unusable
1 Alert: action must be taken immediately
2 Critical: critical conditions
3 Error: error conditions
4 Warning: warning conditions
5 Notice: normal but significant condition
6 Informational: informational messages
7 Debug: debug-level messages
9. The Security Information and Event Management or SIEM market as defined by Gartner covers the advanced generation of solutions that not only harvest audit logs and provide centralized log server functions but parse event log messages and analyze event logs as they are stored. This allows event logs to be correlated to identify hacker activity and attack patterns and notify IT security teams. The best SIEM systems employ a range of artificial intelligence capabilities to recognize threat signatures by cross-referencing events from IPS, IDS and RADIUS systems, Anti-Virus, Host Integrity Monitoring systems, File Integrity Monitoring software, Firewalls, Active Directory and watching for classic hacker activity such as deletion of log files and "brute force" hacks where repeated/sequential logon failures or bad password events will be generated.
10. The goal for any SIEM solution is to provide comprehensive log harvesting, automatically filter out all 'information only' or 'normal operation' events while placing a spotlight on a manageable list of genuine, serious attack patterns or security incidents. Even a medium sized enterprise can have thousands or hundreds of thousands of events generated by devices in their infrastructure so a properly implemented SIEM system is invaluable.

The easy way to get windows event log messages sent to a syslog server - for free

If you are trying to engineer your own solution to meet requirements of a security standard like PCI DSS or GCSx Co Co (GCSx Code of Connection - required for any organisation needing access to the UK Government Secure Extranet) - then you may be scratching your head wondering how best to get event log messages from Windows and/or Unix/Linux servers? Here's how to do it for free - read on.

Well, the Unix and Linux servers may appear relatively straightforward, since you can edit the native syslogd file and specify the address of your syslog server - job done....sort of.

For instance, for PCI DSS compliance, you will need to go further than simply gathering syslog messages and provide a means of tracking file integrity, not to mention the need for gathering custom logs from your key applications and databases - more on this subject in a future blog...

Windows servers present a different challenge, being more oriented to SNMP Traps for performance monitoring than syslog forwarding for security events. NNT have been developing solutions to make the every aspect of 'compliance' simpler and less expensive than it has been in the past. If you haven't already seen our Log Tracker solution you should! This is proving useful for both organisations new to compliance and those that have been around the block with either products that are expensive to maintain in terms of license and maintenance fees, or that are too basic and under powered to cope with their environment. Log Tracker delivers the best of both options - powerful and comprehensive enough to easily cope with large scale windows and unix estates, but priced sensibly for the budget of most organisations that need it.

How does Log Tracker handle Windows Events? Simple - we have a powerful agent that deploys directly to the Windows server. If you don't have much time, just run the installer and tell it the address of the syslog server and you're done. If you want to be more selective about which logs you monitor - including custom application logs, for instance - the there are a range of filtering options.

So how do you get it for free? Just follow this link to www.nntws.com and help yourself - let me know how you get on with it?