-: Log files.
So I mentioned, log files are important
and we just talked about syslog servers
and how we can consolidate all those log files
onto a central repository.
Log files are really important because they allow us
to reconstruct an event after it occurs.
So if we've had an attack, we've been breached,
we lost confidentiality, someone stole our files,
we can use the log files to figure all that out.
How do you maintain those log files though?
Well, you perform log file maintenance.
Log file maintenance is the actions taken
to ensure proper creation and storage of a log file,
such as the proper configuration, saving, backing up,
securing, and encrypting of those log files.
Now when we do all of this, we have to make sure
that we also configure our log files properly.
How do we properly configure them?
Well, we have to make some choices.
How much data should we log?
Maybe you want to log everything, but everything you log
is going to give you more details, and it's going to
take up more space and more processing resources.
And so, if you don't have a big enough hard drive,
you can't log indefinitely everything out there.
And so you're going to have to figure out
what exactly do you need to log?
How big of a scope or how little of a scope?
Then, you have to figure out
how long should your logs be kept?
Because you don't have infinite storage.
You're going to have to archive off your logs.
You're going to have to take them out, and at some point
you have to figure out when do you overwrite the logs?
All of this is important because you're doing a balance.
We want all of the log data because it allows us
to do great auditing after the fact,
but if you have too much log data,
you can end up actually hurting your system.
And so, when you have these logs and they start
getting really large in size, you need to make sure
you're archiving them off.
Now when it comes to log files, where should they be saved?
Well I believe that log files shouldn't be saved
on the same device that is being logged.
So, if my server is being logged, I need to make sure
those logs are actually being saved
to a different partition, a separate hard disk,
or to an external server.
This means that if that server gets attacked or it crashes,
the log files will still be safe so I can put together
the pieces and figure out what happened.
Now in addition to that, you have to think about the size
and scope of what you're logging,
which I already talked about, right?
If you log everything
but you never move those log files off,
you can actually have those files get so large
that they overwhelm the system
by eating up all of its resources
and it can cause the server to crash.
This can become another big issue,
and so it's really important to understand
how you configure your logging.
Another issue you have to consider is what do you do
when the maximum log file size is reached?
If you want to overwrite those events, this will allow you
to overwrite the oldest events to make room
for the newest events in the case
that the maximum log file size is reached.
So for example, here's an example on the screen
of a windows log configuration.
Notice here I have the overwrite selected.
So once that log file reaches the maximum size,
it's going to start overwriting the oldest entries
and then put new entries in.
Now this is good to save space but I'm losing
that other data if it wasn't saved off to someplace else.
And so that's something you have to consider.
How long do you need it to be kept?
Do I need to keep log files for seven days?
For 30 days, for six months, for a year, for seven years?
I don't know.
It depends on your organization.
It depends on your needs.
Some highly regulated organizations need
to keep those log files forever.
Some organizations are good with a seven day window
and then they rewrite it.
"If I haven't been hacked in seven days,
"I don't need those log files."
Again, you're probably going to find yourself
someplace in between.
Something like three months, six months, or a year
is probably somewhere closer to where you need to be
with a maximum amount of time.
Log files should also be archived and backed up
to ensure that they're always available when you need them.
Remember, if it's on the server that's been attacked,
those log files could've been compromised,
and so we want to make sure those log files are constantly
being pushed to a syslog server
or to another backup server someplace else,
where we have good confidentiality
and good integrity of those files.
One way to ensure that is
to use a write once, read many method of data storage.
This can be a technology like a DVD-R,
because once you write it to a DVD-R, it can only
be written once but it can be read unlimited times.
The good thing about this is if somebody hacks into a server
and you've already written it to a DVD-R,
they can't modify those log files,
because it's already been written.
And this is going to make sure that a hacker can't
cover their tracks by modifying or deleting your log files
because they're on a WORM method of storage, as opposed
to being on a standard server that can be modified.
Now the last thing we have to think about with logs
is how do we protect them.
Not just protect them from a hacker getting in
and trying to cover their tracks, but how do we protect them
to make sure we don't lose the confidential
and private information that's located inside these logs.
Well, it's important to encrypt the contents of your logs
to make sure that no prying eyes can see them.
On the Security+ exam, anytime you're trying
to protect something from prying eyes,
anytime you want to make sure that you keep people
out from seeing things, encryption is a great choice.
To do this, you should save your logs to an encrypted folder
on the server or, better yet, to the backup server
and have good file encryption being used
on your backup and archival processes.
This will ensure that your log files
are encrypted in your backups and make sure
that they're only being able to be accessed
by those with a need to know
and those who have that encryption key.