Insufficient Logging
Insufficient logging is failing to record, or under-recording, security events (failed logins, denied access, anomalies), delaying detection and response.
Purpose
To understand security logging requirements and defenses; the foundation of security operations.
Mechanism
Flaws include not logging authentication failures, not logging authorization denials, logs lacking user/IP/timestamp, and logs deletable by attackers. Defenses: log key security events, structured logging, centralized collection, tamper-proofing.
Use cases
- Security monitoring
- Incident response
- Compliance audit