If an attacker succeeds in breaking in, comprehensive logging will identify the stolen or modified data, help the business recover from the incident and prevent similar attacks. What to do ™ Enable users’ audit trail and security logging on all devices. Ensure that only authorised individuals have access to the security logs. ™ Constantly monitor and review security logs to determine if systems have been breached. When monitoring, focus on unusual or suspicious outgoing activity to the Internet or to external portable storage devices. This improves your chances of spotting security breaches. If you want to do more @ Roll out a centralised audit trail so that all security logs are consolidated in a separate location for easier monitoring and security. ® Correlate all security logs and flag up suspicious behaviour. Good ™ rules to have Plan for the extra storage needed to store audit trails as they take up space. — Maintain log-in rules properly and review them periodically. @ Where there are alerts, incident management must be handled properly. m mA a m Pd =| Boa = wu