Forensic Readiness
Forensic examinations are often performed after an incident has occurred. Invariably, one of the lessons learned as a result of these investigations is that the audit logs could be improved to make any future investigation easier and more productive.
Accurate logs and a clear audit trail are one of those things that are not given much thought until a problem occurs and then it is too late to make any changes. To avoid this situation, where shortcomings are not discovered until it is too late, it is recommended that all organisations conduct a forensic readiness review.
Some key questions that should be asked are:
- Are the logs retained for a sufficient time? How far back might you need to look in the worst case and would logs go back far enough? Some industries have regulations that mandate retention periods.
- Do all key systems have logs? In a typical web server system this would include the firewalls, web server, application server, database server and possibly also the authentication server.
- Are the system clocks time synchronised? Without accurate clocks, it would not be possible to correlate logs between different systems. Normally NTP will be used to provide sub-second clock synchronisation.
- Is all the necessary information being logged? Many systems will log voluminous amounts of data, but is it the right data? Things like the HTTP referer in the web log are often omitted by default but can be useful when investigating an incident.
- Are measures in place to ensure that there are no gaps in the logs? Things to consider include disks filling up and disk failure. Manual log rotation and archiving is too error-prone to be relied upon.
- Are the logs stored in a way that protects against tampering? Sending the logs to a separate secure system is generally the best method.
Once the basic questions have been addressed, organisations should consider a few likely scenarios and determine if the information in the logs would be sufficient. These scenarios should reflect the likely vulnerabilities for the environment and also the common ways that an attacker might use to exploit these vulnerabilities.
A Forensic readiness review should be thought of as similar to testing a disaster recovery plan. If you have ever been involved in testing a DR plan, you will know just how much is learnt from the exercise.