Guide to Computer Security Log Management¶
Kent, K., & Souppaya, M. (2006). Guide to Computer Security Log Management. National Institute of Standards and Technology.
Cited by¶
6 citations across 6 artifacts.
Each citation links to the sentence it supports in the citing article.
Mechanisms¶
- Audit Log and Trace
- The guarding discipline is to make the log feed enforcement and review rather than substitute for them, and to scrub or tier sensitive fields so the record stays trustworthy without becoming its own hazard.
This sourceWarns that logs may capture sensitive information and therefore require confidentiality and integrity protections while remaining available for review and incident response.
- The guarding discipline is to make the log feed enforcement and review rather than substitute for them, and to scrub or tier sensitive fields so the record stays trustworthy without becoming its own hazard.
- Audit Trail Record
- Its strength is accountability and reconstruction: it makes the linking system reviewable, supports non-repudiation — a party cannot credibly deny an action the trail records
This sourceUses retained security logs to support accountability and independent review of system activity.
- Its strength is accountability and reconstruction: it makes the linking system reviewable, supports non-repudiation — a party cannot credibly deny an action the trail records
- Change Log and Audit Trail
- Its failure modes are quiet: a log that records what changed but not why gives thin assurance, and a log that can itself be edited gives false assurance — the appearance of an audit trail with none of the protection.
This sourceExplains why log context and integrity protections are necessary to interpret events and prevent altered records from concealing activity.
- Its failure modes are quiet: a log that records what changed but not why gives thin assurance, and a log that can itself be edited gives false assurance — the appearance of an audit trail with none of the protection.
- Context Migration Record
- Anchored well, it functions as an append-only audit log,
This sourceRequires protecting logs against alteration and explains that deletion or modification can remove evidence needed to reconstruct events.
- Anchored well, it functions as an append-only audit log,
- Disclosure Audit Log
- An editable log can be altered to erase the very disclosure that mattered, which is why append-only integrity is load-bearing.
This sourceRecommends protecting log files from unauthorized modification, including through write-once media where stronger integrity is required.
- An editable log can be altered to erase the very disclosure that mattered, which is why append-only integrity is load-bearing.
- Log Rotation and Cleanup Job
- The discipline is to route audit-bearing streams through an archive tail (not delete) and to let a real retention schedule, not the rotation depth alone, govern anything with a compliance obligation.
This sourceRequires logs subject to legal or regulatory retention to be archived before clearing and retained according to the organization’s retention policy.
- The discipline is to route audit-bearing streams through an archive tail (not delete) and to let a real retention schedule, not the rotation depth alone, govern anything with a compliance obligation.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Not recorded. Neither this nor any other of the 6 citations of this work carries a recorded support check.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 1 other way.
Registry ID ref:6a20960d54f4 · see in the full table