#9
A09:2021
Security Logging and Monitoring Failures
This category helps detect, escalate, and respond to active breaches. Without logging and monitoring, breaches cannot be detected.
개요
Previously Insufficient Logging & Monitoring. This category is expanded to include more types of failures, is challenging to test for, and isn't well represented in CVE/CVSS data.
공격자가 이것을 악용하는 방법
공격 패턴을 이해하면 더 나은 방어를 구축하는 데 도움이 됩니다. 이것들은 보안 팀이 주시하는 기술입니다.
Undetected breach
Without proper logging, attackers can operate undetected for extended periods, exfiltrating data gradually.
탐지 신호:
This is the problem - without logging, there IS no indicator
Log tampering
Attackers with access modify or delete logs to cover their tracks.
탐지 신호:
Gaps in log sequences, modified timestamps, missing entries
예방 방법
- Log all login, access control, and server-side input validation failures
- Ensure logs are in a format easily consumed by log management solutions
- Ensure log data is encoded correctly to prevent injection attacks
- Ensure high-value transactions have an audit trail with integrity controls
- Establish effective monitoring and alerting for suspicious activities
- Establish an incident response and recovery plan
Shoulder 탐지가 있는 CWE (3)
이 CWE들은 Shoulder 탐지 규칙이 있습니다. 클릭하여 특정 취약점과 수정 사항을 확인하세요.
기타 매핑된 CWE (2)
이 CWE들은 이 카테고리에 매핑되어 있지만 아직 Shoulder 규칙이 없습니다.