OPS.1.1.5 Logging

Based on an organisation's general security policy, a specific security policy SHOULD be drawn up for logging. This security policy MUST transparently describe requirements and specifications on how logging is to be planned, set up, and securely operated. The security policy MUST specify what is to be logged, as well as how and where. Here, the type and scope of logging SHOULD be based on the protection needs of the information in question.

The security policy MUST be drawn up by the CISO together with the Process Owners. It MUST be known to all employees in charge of logging and be integral to their work. If the security policy is changed or deviations from its requirements are allowed, this MUST be coordinated with the CISO and documented. The correct implementation of this specific security policy MUST be regularly reviewed. The results of these reviews MUST be documented.

All security-relevant events pertaining to IT systems and applications MUST be logged. If the IT systems and applications defined as relevant in a logging policy have a logging function, it MUST be used. When setting up logging, the manufacturer specifications for the relevant IT systems or applications MUST be considered.

Spot checks MUST be carried out at appropriate intervals to ensure that logging is still functioning correctly. The intervals of these checks MUST be defined in the logging policy at hand.

If events relevant to operations and security cannot be logged on an IT system, additional IT systems MUST be integrated for logging (e.g. for events at the network level).

The system time of all IT systems and applications that generate logs MUST always be synchronous. It MUST be ensured that the date and time formats of log files are uniform.

The regulations of the current laws on federal- and state-level data protection MUST be followed during logging (see CON.2 Data Protection).

Moreover, any personal rights and/or rights of co-determination of the Employee Representatives in question MUST be observed.

Compliance with any other relevant legal regulations MUST also be ensured.

Log data MUST be deleted in accordance with a specified process. Technical provisions MUST prevent log data being deleted or changed in an uncontrolled manner.

All security-relevant logging data SHOULD be stored in a central location. To this end, a central logging infrastructure (read: a log server system) SHOULD be designed and placed in a network segment created for this purpose (see NET.1.1 Network Architecture and Design).

In addition to security-relevant events (see OPS.1.1.5.A3 Configuring Logging at the System and Network Level), a central logging infrastructure SHOULD log general operational events that indicate errors.

The logging infrastructure SHOULD have sufficient capacity. The possibility of scaling up this infrastructure to support extended logging SHOULD be considered. To this end, sufficient technical, financial, and personnel resources SHOULD be available.

Log data SHOULD be archived. The relevant legal regulations SHOULD be taken into account in the process.

Collected log data SHOULD be filtered, normalised, aggregated, and correlated. Log data processed in this way SHOULD be made available in a manner suitable for assessment.

Logging applications SHOULD have corresponding interfaces to programs capable of automatic data analysis.

It SHOULD be ensured that the evaluation of log data complies with the security requirements defined in the respective logging policy. Operational and internal agreements SHOULD also be taken into consideration when making log data available.

Log data SHOULD be stored unchanged in its original format.

It SHOULD be ensured that administrators who execute logging have no authorisation to modify or delete recorded log data.

If applications or IT systems require increased protection, more events SHOULD be logged so that security-relevant incidents can be traced as comprehensively as possible.

To ensure that log data can be evaluated in real time, it SHOULD be stored centrally at shorter intervals by the relevant IT systems and applications. Logging SHOULD enable assessment of the entire information domain in question. Applications and IT systems that do not allow for central logging SHOULD NOT be used in case of increased protection needs.

Log data SHOULD be encrypted for secure transfer. All saved logs SHOULD be digitally signed. Archived log data and log data stored outside the corresponding logging infrastructure SHOULD also always be stored in an encrypted manner.

A highly available logging infrastructure SHOULD be created.