Turning log files into a security asset

Comparison of File Integrity Monitoring (FIM) techniques for small business networks

“…A log management solution should allow for different types of log messages to be implemented as well as to provide better accountability into the activity seen within the environment [16]. When considering combining an FIM with a log management solution, the following considerations should be made:…”

A Log File Digital Forensic Model

“…A typical organization has many network devices that, if configured correctly, can generate and store log files of user activities [8]. In order to make sense of all the data provided in continuous streams by network devices, dedicated logging infrastructures (log file servers) have been developed to support the storage and management of logs [8]. Some of the techniques include console logging, buffered logging, terminal logging, syslog, Simple Network Management Protocol (SNMP) traps and the Authentication, Authorization and Accounting (AAA) protocol [29].…”

“…The second layer, called the discovery layer, follows the preparation layer ( Figure 1). In this layer, tests and experiments are carried out on the network devices to identify the digital footprints of the suspects [8]. The goal is to discover a link between the suspects and the incident.…”

“…Cyber criminals typically use computers connected to the Internet to penetrate computer networks. The attack traffic has to pass through various network devices because the computers used to launch the attack and the targeted system are usually on different networks [8]. These network devices can provide investigators with digital footprints that could reveal details of the techniques and the identities of the individuals and machines responsible an attack [19].…”

“…These network devices can provide investigators with digital footprints that could reveal details of the techniques and the identities of the individuals and machines responsible an attack [19]. If the network devices are configured properly, each attack action could leave digital footprints in the log files of the devices [8]. Log files provide significant evidence because they record all the activities that take place in an organization's computer network [19,26].…”