Hello! π In our OWASP Top 10 Conquest Series, today we’ll explore A09:2021-Security Logging and Monitoring Failures, a silent threat that allows attacks to occur unnoticed.
What if your home has state-of-the-art locks, but no CCTV to record intruders, or if no one ever checks the recorded footage? π΅οΈββοΈ ‘Security Logging and Monitoring Failures’ refers to a state where critical security events occurring in a system are not properly recorded (logging), or recorded logs are not analyzed to detect anomalies (monitoring). Let’s explore the importance of logging and monitoring, which serve as the eyes and ears of our system!
π€ Security Logging and Monitoring Failures? What exactly is it?
“A state where, when an incident occurs, you can’t tell what happened, who did it, or how they got in.” π
Security Logging and Monitoring Failures is a broad vulnerability encompassing the following issues:
- Insufficient Logging: Important security events such as login attempts, failures, and administrator actions are not recorded at all, or too little information is left even if recorded.
- Improper Log Storage: Logs are stored in a format that can be easily tampered with, or kept for too short a period, causing logs to disappear by the time of incident analysis.
- Lack of Monitoring: Logs merely accumulate, but no one periodically reviews their content or analyzes them in real-time to detect anomalies (e.g., hundreds of login failures).
- Ineffective Alerting: When anomalies are detected, there is no system to immediately notify the responsible person, or too many false positives cause real threats to be missed.
This problem is serious because even if an attack occurs through other security vulnerabilities (SQL injection, access control failures, etc.), it deprives the opportunity to recognize and respond to it. Attackers can freely exploit the system without leaving a trace.
π΅οΈββοΈ Commonly Found Logging and Monitoring Failure Cases
In what cases can logging and monitoring be said to have ‘failed’?
1. Not knowing what to log πβ
This is the most basic problem.
- Problem: Security-critical events are not defined, leading to application logs being filled only with business logic-related content, while important security events are not recorded.
- Essential events to log:
- All login successes and failures
- Password change and reset attempts
- CRUD (Create, Read, Update, Delete) operations on important data
- Administrator privilege operations (e.g., adding/deleting users)
- Access control failures (attempts to access unauthorized pages)
- Application errors and exceptions
2. Insufficient information in logs π΅οΈ
A half-baked record that doesn’t tell “who” did it.
- Problem: Only the fact that an event occurred is recorded, but context information such as the IP address of the user who triggered the event, account ID, time, and which function was accessed is missing.
- Example: Only a “login failed” log is left, without recording which IP and which account attempted it, making it impossible to analyze brute-force attacks.
3. Important alerts being ignored π¨β‘οΈπ
Similar to the “Boy Who Cried Wolf” effect.
- Problem: The monitoring system generates too many alerts, causing responsible personnel to become desensitized to warnings and miss genuinely important attack attempts. Or, there is no process to immediately check and respond to alerts when they occur.
- Example: Threshold-based alerts like “100+ login failures within 5 minutes” are not set, or even if an alert occurs, the responsible person only checks it the next morning.
4. Log integrity and protection failures ππ
Evidence is tampered with or disappears.
- Problem: One of the first things attackers do after infiltrating a system is to delete or tamper with log files to erase their tracks. If access control to log files is weak, or there are no measures to prevent tampering, you can be defenseless.
- Example: Web server access logs have incorrect permission settings, allowing them to be modified/deleted even by regular user accounts.
π‘οΈ How can we prevent it? (Defense Methods)
The key to building an effective logging and monitoring system is “meaningful recording, secure storage, and rapid detection.”
- Establish a centralized logging system ποΈ: Logs generated from multiple servers and applications should be sent to a centralized log management system such as ELK (Elasticsearch, Logstash, Kibana) stack, Splunk, or Graylog for integrated management and analysis.
- Standardize log format and ensure context β : All logs should be recorded in a consistent format (e.g., JSON) and include sufficient context information to clearly know “When (Timestamp), Where (Source IP), Who (User ID), What (Event Type), and How (Details)” for every event.
- Strengthen log integrity and access control π‘οΈ:
- Log files must be managed with strict permissions to prevent modification by regular users or application accounts.
- Collected logs can be stored in WORM (Write Once Read Many) storage to prevent tampering, or blockchain technology can be used to ensure integrity.
- Real-time monitoring and automated alerts π‘π¨: Use SIEM (Security Information and Event Management) solutions or automated scripts to analyze logs in real-time, and establish a system to immediately send alerts via Slack, email, SMS, etc., to the responsible person when predefined thresholds or abnormal patterns (Anomaly) are detected.
- Regular audits and response training π¨βπ«: Regularly review logs to audit for potential threats, and practice processes for quick and accurate response when alerts occur through simulated hacking exercises.
β¨ Conclusion
Security logging and monitoring, though not a flashy defense technique, are the most crucial ‘eyes’ and ‘ears’ that form the foundation of all security activities. No matter how strong a fortress wall is built, if the enemies trying to cross it are not monitored, the fortress will eventually fall.
Why not open your system’s log files right now and ask yourself, “If I were hacked right now, would I even know it?” Making invisible threats visible β that is the true beginning of security.
Tags: OWASP, A09, Logging, Monitoring, SIEM, Security Operations, Incident Response, Information Security
Leave a Reply