+RA-05(08) Review Historic Audit Logs
|
RA-05(08) Review Historic Audit Logs
Control
Review historic audit logs to determine if a vulnerability identified in a [Assignement: system] has been previously exploited within an [Assignement: time period].
Discussion
Reviewing historic audit logs to determine if a recently detected vulnerability in a system has been previously exploited by an adversary can provide important information for forensic analyses. Such analyses can help identify, for example, the extent of a previous intrusion, the trade craft employed during the attack, organizational information exfiltrated or modified, mission or business capabilities affected, and the duration of the attack.
Assessment Objective
historic audit logs are reviewed to determine if a vulnerability identified in a [Assignement: system] has been previously exploited within [Assignement: time period].
Assessment Method
Examine
Risk assessment policy
procedures addressing vulnerability scanning
audit logs
records of audit log reviews
vulnerability scanning results
patch and vulnerability management records
system security plan
other relevant documents or records
Interview
Organizational personnel with vulnerability scanning responsibilities
organizational personnel with vulnerability scan analysis responsibilities
organizational personnel with audit record review responsibilities
system/network administrators
organizational personnel with security responsibilities
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|