CIS #8: Audit Log Management

To kick off the new year we are looking at Control 8 from the Center for Information Security (CIS) framework, which covers the management and monitoring of audit logs.

Every time you connect a device to the network or traffic passes through your firewall, a record of that event is stored, and those records are known as audit logs. By collecting, storing, and analyzing audit logs it allows IT professionals to identify unauthorized access, configuration changes, malware infections, and other security incidents. Not only does audit log management allow for security breaches to be detected and resolved much quicker, but they also help to confirm the source and scope of the breach in ways that other tools cannot.

Additionally, Control 8 improves accountability and transparency around who is accessing your most sensitive data within your organization. This is an important addition, because not every security breach originates from a stranger on the Internet. And in the case that a security breach requires legal involvement, audit logs are among the first requests from lawyers and law enforcement. So, if you’d like more information about this control, please contact your team lead or vCIO.