Security Audit Log Analysis Guideline

On This Page

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data.  The recommendations below are provided as optional guidance for audit logging requirements.

Requirement

Resource Custodians must maintain, monitor, and analyze security audit logs for covered devices.

Description of Risk

Without appropriate audit logging and analysis, an attacker's activities can go unnoticed, and evidence of whether or not the attack led to a breach can be inconclusive.

Recommendations

Once audit logs are setup to be collected, regular log reviews and analysis are critical to timely detection of security incidents, policy violations, fraudulent activities and any follow-up response actions that are required.  Proper audit log analysis will require resource propprietor to dedicate time of a log analyst on a daily basis to review logs for urgent errors and warnings.  Log analyst should also develop periodic reports to demonstrate trending and time dependent data to aid the discovery of anomalous events and activities otherwise hidden from daily reviews.  

To help priortize review and response time, log analyst should develop criticality rating for audit events based on potential negative to covered data.  Using the criticality rating, log analyst should develop capability to send alert on high criticality rating (anomalous) events in real time for timely response to probably security incidents.

Due to the complexity of an audit logging program implementation, it is strongly recommended that resource proprietors and resource custodians enroll in the campus-provided audit logging service described below.

Campus Service

Information Security and Policy (ISP) has implemented Campus Log Correlation Program, an enterprise grade audit logging software solution (based on HP ArcSight), to aid in managing, correlating, and detecting suspicious activities related to the campus' most critical data assets.  This service's advanced detection capabilities enable ISP to correlate events in multiple dimensions - by identity, vulnerability, asset, time, patterns and other events -  across firewalls, web servers, system access logs, and other core central Security Services such as Vulnerability and Intrusion Detection to determine if a system has been successfully attacked, is currently being probed for attack, or detect advanced threats before they cause damage.  

To enroll in ISP Campus Log Correlation Program, please email your request to security@berkeley.edu.