#9
A09:2021
Security Logging and Monitoring Failures
This category helps detect, escalate, and respond to active breaches. Without logging and monitoring, breaches cannot be detected.
概要
Previously Insufficient Logging & Monitoring. This category is expanded to include more types of failures, is challenging to test for, and isn't well represented in CVE/CVSS data.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Undetected breach
Without proper logging, attackers can operate undetected for extended periods, exfiltrating data gradually.
検出シグナル:
This is the problem - without logging, there IS no indicator
Log tampering
Attackers with access modify or delete logs to cover their tracks.
検出シグナル:
Gaps in log sequences, modified timestamps, missing entries
予防方法
- Log all login, access control, and server-side input validation failures
- Ensure logs are in a format easily consumed by log management solutions
- Ensure log data is encoded correctly to prevent injection attacks
- Ensure high-value transactions have an audit trail with integrity controls
- Establish effective monitoring and alerting for suspicious activities
- Establish an incident response and recovery plan
Shoulder検出付きCWE (3)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
その他のマップされたCWE (2)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。