Chapter 8 — Logs that a small team can use | Postgraduate Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Choosing events"]
  N2["8.2 Central collection"]
  N3["8.3 Weekly review"]
  N4["8.4 Privacy"]
  N5["Endpoint protection alerts"]
  N6["Reviewing the review and its blind spots"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Choosing events"]
  N2["8.2 Central collection"]
  N3["8.3 Weekly review"]
  N4["8.4 Privacy"]
  N5["Endpoint protection alerts"]
  N6["Reviewing the review and its blind spots"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 Choosing events]
    |
    v
[8.2 Central collection]
    |
    v
[8.3 Weekly review]
    |
    v
[8.4 Privacy]
    |
    v
[Endpoint protection alerts]
    |
    v
[Reviewing the review and its blind spots]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) choose endpoint events; (2) centralise them; (3) review weekly.

8.1 Choosing events

NIST SP 800-92 advises deciding what to log before collecting. Priya chooses sign-in failures, new local accounts, security software disabled and changes to the exception devices. Each event answers a question Kestrel cares about. Repeated sign-in failures may show guessing, a new local account may be a way to keep access, disabled security software may be the first sign of a compromise, and changes on excepted machines matter because those machines cannot be patched. Choosing a short list keeps review possible for a small organisation with no dedicated security team, and every event chosen has a named person to review it.

8.2 Central collection

Events forward to the supplier's log service, retained for 90 days. Clock synchronisation is checked, since times must line up across clinics. Ninety days covers a quarter, which matches Kestrel's review cycle and gives time to investigate a problem found late. Clock synchronisation matters because an investigation may need to compare a sign-in at one clinic with a change on an imaging PC at another. Priya checks that every device, including the excepted imaging PCs on their isolated segment, actually sends events, since a missing source looks the same as a quiet one. The supplier confirms the forwarding settings in writing, including for the imaging PCs on the isolated segment, so a silent source is noticed.

8.3 Weekly review

A short weekly review covers a few defined questions. Each finding is resolved or explained. Priya and the supplier agree the questions: were there repeated sign-in failures, new local accounts, disabled security software or changes to excepted machines? The supplier answers each one in a short note. A finding that needs action is passed to the operations manager, and an explained event, such as a planned software install, is recorded with its reason. Keeping the review short makes it likely to happen every week, and the notes show auditors that it did. Priya checks the notes monthly during the project, looking for questions that were skipped or findings left without an outcome.

8.4 Privacy

Logs contain staff names; access is restricted and use limited to security. Because security logs record when staff sign in and what they do on shared machines, they could be misused to monitor performance or attendance. Kestrel's log policy states that logs are used only to protect systems and patient data, names the supplier staff who can read them, and keeps access records. Staff are told what is collected and why. The policy also sets the 90-day retention, so data is not kept longer than the purpose needs. Priya asks the data protection lead to approve the policy before collection begins.

Endpoint protection alerts

The endpoint protection product raises its own alerts, such as blocked files or suspicious behaviour. These go to the supplier's help desk, which must acknowledge them within one working day. Priya reviews a month of alerts with the supplier and finds most are low-value detections of unwanted browser toolbars. Tuning the product to block these silently reduces noise so that serious alerts stand out.

She writes a short escalation rule: any alert on an imaging exception device, or any alert about disabled protection, is phoned to the operations manager the same day rather than waiting in a queue.

Reviewing the review and its blind spots

A weekly review that quietly stops is worse than none, because everyone assumes it is happening. Each quarter Priya checks the saved review notes and counts missed weeks; missed weeks are discussed without blame and the routine is moved if needed, for example to a quieter day. She also records what the logs cannot show. An imaging PC without the protection agent produces no alerts at all, so its silence is not reassurance. These blind spots are listed against each device in the exception register, which makes clear that isolation and allowlisting, not monitoring, are the main controls for those machines.

Worked example

The first month's review finds one disabled antivirus on a reception PC after a vendor tool install; it is re-enabled and the tool's installer adjusted.

Synthetic case. Events are synthetic.

Errors and limits

Collecting everything overwhelms a small team; collecting nothing leaves incidents invisible.

Exercises

EX036 — Event choice. Name three useful endpoint events.
Show marking criteria
Rubric: 3 = three relevant with reasons;; 2 = three;; 1 = fewer;; 0 = none.
EX037 — Clocks. Why synchronise clocks?
Show marking criteria
Rubric: 3 = correlation across sites;; 2 = vague;; 1 = minimal attempt;; 0 = none.
EX038 — Retention. Justify a 90-day retention period.
Show marking criteria
Rubric: 3 = balances investigation and privacy;; 2 = one side;; 1 = vague;; 0 = none.
EX039 — Review questions. Write two weekly review questions.
Show marking criteria
Rubric: 3 = specific and answerable;; 2 = vague;; 1 = minimal attempt;; 0 = none.
EX040 — Exception devices. Why watch exception devices closely?
Show marking criteria
Rubric: 3 = higher residual risk;; 2 = vague;; 1 = minimal attempt;; 0 = none.

Synthesis

A few chosen events, reviewed regularly, beat a large unused log store.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →