Auditing and Logging

From Guidance Share

Description

Auditing and logging should be used to help detect suspicious activity such as footprinting or possible password cracking attempts before an exploit actually occurs. Itcan also help deal with the threat of repudiation. It is much harder for a user to deny performing an operation if a series of synchronized log entries on multiple servers indicate that the user performed that transaction.

Impact

• User Denies Performing an Operation
• Attackers Exploit an Application Without Leaving a Trace
• Attackers Cover Their Tracks

Vulnerabilities

• Anonymous access enabled

Attacks

• Repudiation Attack

Countermeasures

Countermeasures to prevent Auditing and Logging attacks include:

• Disable anonymous access and authenticate every principle

Done