Chapter 7 — Security governance, risk and compliance: data and telemetry
Lesson map
Lesson 07 published. Map, example, EX025.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Logs as data"]
N2["7.2 Counting failures"]
N3["Lab — Counting failed sign-ins per account"]
N4["7.3 Acting on alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX025"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Logs as data"]
N2["7.2 Counting failures"]
N3["Lab — Counting failed sign-ins per account"]
N4["7.3 Acting on alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX025"]
[Learning outcomes]
|
v
[7.1 Logs as data]
|
v
[7.2 Counting failures]
|
v
[Lab — Counting failed sign-ins per account]
|
v
[7.3 Acting on alerts]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX025]
Learning outcomes
You will (1) use logs as governance data; (2) count and flag unusual events; (3) decide what to do with alerts.
7.1 Logs as data
Systems record events such as sign-ins, changes and errors. Amina learns that logs are governance data: they show whether controls work and whether something unusual happened. Fenwick's cloud services produce sign-in logs with time, result and account. She learns to read them with a script and that keeping logs for a defined period is often required by policy and by payment card rules, so retention must be planned. Ms. Bell notes that a retention period chosen without checking payment card rules may delete logs that an assessor later asks for.
7.2 Counting failures
The lab reads twelve sign-in log lines and counts failures per account. The admin account has seven failures in a few minutes and is flagged because it exceeds five. j.park has two failures followed by a success, likely a mistyped password. s.ali has one failure. Three accounts had failures in total. Amina notes that repeated failures on an administrator account could indicate someone guessing the password. j.park's success straight after two failures fits a typing error far better than an attack on that account.
Lab — Counting failed sign-ins per account
"""Count failed sign-ins per account from synthetic log lines; flag accounts above 5."""
from collections import Counter
log = """2026-09-14T08:01 FAIL j.park
2026-09-14T08:02 FAIL j.park
2026-09-14T08:02 OK j.park
2026-09-14T09:10 FAIL admin
2026-09-14T09:10 FAIL admin
2026-09-14T09:11 FAIL admin
2026-09-14T09:11 FAIL admin
2026-09-14T09:12 FAIL admin
2026-09-14T09:12 FAIL admin
2026-09-14T09:13 FAIL admin
2026-09-14T10:30 FAIL s.ali
2026-09-14T10:31 OK s.ali"""
c = Counter(l.split()[2] for l in log.splitlines() if " FAIL " in l)
for a, n in c.most_common(): print(f"{a}: {n} failures{' ALERT' if n > 5 else ''}")
print(f"lines {len(log.splitlines())}; accounts with failures {len(c)}")
Run with python3 lab_logs.py. Verified output:
admin: 7 failures ALERT
j.park: 2 failures
s.ali: 1 failures
lines 12; accounts with failures 3
7.3 Acting on alerts
Amina reports the admin account alert to the IT lead. They check and find the failures came from an unknown internet address. The account already had multi-factor authentication, so the guesses failed. The IT lead blocks the address and renames the generic admin account. Amina learns that alerts need a response procedure and that context, such as source address and whether other controls held, determines how serious an alert is. Renaming the generic admin account also makes it a less obvious target for the same guessing.
Worked example
Amina counts sign-in failures, flags seven on the admin account and supports a response that blocks the source and renames the account.
Synthetic case. Log lines are synthetic.
Errors and limits
Simple thresholds miss slow attacks. Logs can be incomplete.
Exercises
- EX025 — Log retention. Why must log retention be planned? Rubric: 3 = policy and card rules often require it;; 2 = requirements;; 1 = vague;; 0 = none.
- EX026 — Flagged account. Which account was flagged and why? Rubric: 3 = admin, 7 failures above 5;; 2 = admin;; 1 = j.park;; 0 = none.
- EX027 — j.park reading. How did Amina interpret j.park's failures? Rubric: 3 = likely a mistyped password, followed by success;; 2 = typo;; 1 = vague;; 0 = none.
- EX028 — Response actions. What actions followed the alert? Rubric: 3 = block the address and rename the admin account;; 2 = two;; 1 = vague;; 0 = none.
Synthesis
Logs become governance data when counted, flagged and acted on with context.
Continue studying — chapter 07 of 18
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →