#9
A09:2021
Security Logging and Monitoring Failures
This category helps detect, escalate, and respond to active breaches. Without logging and monitoring, breaches cannot be detected.
概述
Previously Insufficient Logging & Monitoring. This category is expanded to include more types of failures, is challenging to test for, and isn't well represented in CVE/CVSS data.
攻击者如何利用此漏洞
理解攻击模式有助于您构建更好的防御。这些是安全团队监控的技术。
Undetected breach
Without proper logging, attackers can operate undetected for extended periods, exfiltrating data gradually.
检测信号:
This is the problem - without logging, there IS no indicator
Log tampering
Attackers with access modify or delete logs to cover their tracks.
检测信号:
Gaps in log sequences, modified timestamps, missing entries
如何预防
- Log all login, access control, and server-side input validation failures
- Ensure logs are in a format easily consumed by log management solutions
- Ensure log data is encoded correctly to prevent injection attacks
- Ensure high-value transactions have an audit trail with integrity controls
- Establish effective monitoring and alerting for suspicious activities
- Establish an incident response and recovery plan
有Shoulder检测的CWE (3)
这些CWE有Shoulder检测规则。点击查看具体漏洞和修复方法。
其他映射的CWE (2)
这些CWE映射到此类别，但尚无Shoulder规则。