Blog Post

If you’re a business owner or manager, you are likely well aware of the importance of having a robust cybersecurity system in place. You may also have a stout cyber office policy for your team to be informed and follow best practices to protect your business and customers. However, there is one component that is crucial to your cyber practices that you might not be aware of. It’s called event logging, and it is a powerful strategy similar to digital detective work. It is the practice of tracking all events that happen within your business IT systems and can help you quickly spot a potential security breach, allowing you to react fast and efficiently to minimize any damage. 

The kinds of events you would want to log and track are things like: login attempts, system changes, network traffic, software installations, file access, and denial of access. When tracking events such as these, it’s important to add a timestamp to give a full and clear picture of what’s happening in your business IT world. These logged events can be incredibly proactive for you to detect suspicious activity, respond quickly, and meet industry regulations easily.  

Here are some best practices for logging events effectively: 

1. Log the things that matter most. It’s not necessary to log every digital footstep (and who has the time for that anyway?). Focus instead on the events that can be compliance risks and security breaches. Examples of this would be:
   • Logins and logouts to give an overall picture of who is accessing your accounts and when, including failed password attempts or changes and new user accounts. 
   • System changes to include configuration changes and updates to keep you aware of what’s going on in your system and protect you from any backdoor activity.
   • Tracking who is able to see your sensitive data by logging file and database access. 
2. Centralize all your logs into one place using a Security Information and Events Manager (SIEM). This can include logged information across various devices, applications, and servers. This is especially helpful in spotting patterns of suspicious activity, see a complete picture of your network as a whole, including your vulnerabilities, and allows you to respond faster to anything needing attention. 
3. Make sure that your logs are tamper-proof, especially from bad actors who might gain access to your system. You can do this by encrypting your logs, using strong access controls that limit who can see and alter your logs, and by using Write Once, Read Many(WORM) storage to lock it in place.
4. Develop a solid log retention policy and stick to it.  Most businesses are already overwhelmed with data so you don’t want to hold onto logs unnecessarily, while also avoiding deleting them too soon, which can be risky. Some things to consider in developing this policy are: compliance requirements that are within your industry, which may specify just how long you need to retain your logs; your storage capacity; and your individual business needs for investigations or audits. 
5. Check your logs regularly. This allows you to be aware of any irregularities and suspicious activity. Consider using security software to help you streamline and automate this process. You can also set up automated alert, perform periodic checks, and connect all the dots using your SIEM. 

At Tech Eagles, we know the battle in the cyber war is long and hard fought. But you aren’t alone. Give us a call today to learn how Tech Eagles can be both your shield and weapon in this war. We offer a wide range of IT and cyber services that can be tailored to your business’ needs. Talk to you soon!