+Secure Handling of Log Data

Secure Handling of Log Data

Implement measures to secure and handle log data, taking into account the purpose for which the logs were created. Establish measures to detect failures in logging systems. Protect the recording of anomalous activities against tampering and unauthorised access at rest, in use, where relevant, and in transit.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări
EULAW Articolul 10 (1)
Entitățile financiare dispun de mecanisme pentru detectarea rapidă a activităților anormale, în conformitate cu articolul 17, inclusiv a problemelor legate de performanța rețelei TIC și a incidentelor legate de TIC, precum și pentru identificarea posibilelor puncte unice de defecțiune semnificative.

Toate mecanismele de detectare menționate la primul paragraf sunt testate cu regularitate în conformitate cu articolul 25.
EULAW Articolul 10 (2)
Mecanismele de detectare menționate la alineatul (1) permit niveluri multiple de control, definesc praguri de alertă și criterii de declanșare și inițiere a proceselor de răspuns la incidentele legate de TIC, inclusiv mecanisme de alertă automată pentru personalul relevant responsabil de răspunsul la incidentele legate de TIC.
EULAW Articolul 10 (3)
Entitățile financiare alocă suficiente resurse și capacități pentru a monitoriza activitatea utilizatorilor, apariția anomaliilor TIC și a incidentelor legate de TIC, în special a atacurilor cibernetice.
EULAW Articolul 10 (4)
Furnizorii de servicii de raportare a datelor dispun, în plus, de sisteme care pot verifica în mod eficace integralitatea rapoartelor de tranzacționare, pot identifica omisiunile și erorile evidente și pot solicita retransmiterea rapoartelor respective.
EULAW Article 9 1.

As part of the ICT security policies, procedures, protocols, and tools referred to in Article 9(2) of Regulation (EU) 2022/2554, financial entities shall develop, document, and implement capacity and performance management procedures for the following:

(a) 

the identification of capacity requirements of their ICT systems;

(b) 

the application of resource optimisation;

(c) 

the monitoring procedures for maintaining and improving:

(i) 

the availability of data and ICT systems;

(ii) 

the efficiency of ICT systems;

(iii) 

the prevention of ICT capacity shortages.
EULAW Article 9 2.
The capacity and performance management procedures referred to in paragraph 1 shall ensure that financial entities take measures that are appropriate to cater for the specificities of ICT systems with long or complex procurement or approval processes or ICT systems that are resource-intensive.
EULAW Article 12 1.
Financial entities shall, as part of the safeguards against intrusions and data misuse, develop, document, and implement logging procedures, protocols and tools.
EULAW Article 12 2.

The logging procedures, protocols, and tools referred to in paragraph 1 shall contain all of the following:

(a) 

the identification of the events to be logged, the retention period of the logs, and the measures to secure and handle the log data, considering the purpose for which the logs are created;

(b) 

the alignment of the level of detail of the logs with their purpose and usage to enable the effective detection of anomalous activities as referred to in Article 24;

(c) 

the requirement to log events related to all of the following:

(i) 

logical and physical access control, as referred to in Article 21, and identity management;

(ii) 

capacity management;

(iii) 

change management;

(iv) 

ICT operations, including ICT system activities;

(v) 

network traffic activities, including ICT network performance;

(d) 

measures to protect logging systems and log information against tampering, deletion, and unauthorised access at rest, in transit, and, where relevant, in use;

(e) 

measures to detect a failure of logging systems;

(f) 

without prejudice to any applicable regulatory requirements under Union or national law, the synchronisation of the clocks of each of the financial entity’s ICT systems upon a documented reliable reference time source.

For the purposes of point (a), financial entities shall establish the retention period, taking into account the business and information security objectives, the reason for recording the event in the logs, and the results of the ICT risk assessment.
EULAW Article 23 2.

The mechanism to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, as referred to in Article 10(1) of Regulation (EU) 2022/2554, shall enable financial entities to:

(a) 

collect, monitor, and analyse all of the following:

(i) 

internal and external factors, including at least the logs collected in accordance with Article 12 of this Regulation, information from business and ICT functions, and any problem reported by users of the financial entity;

(ii) 

potential internal and external cyber threats, considering scenarios commonly used by threat actors and scenarios based on threat intelligence activity;

(iii) 

ICT-related incident notification from an ICT third-party service provider of the financial entity detected in the ICT systems and networks of the ICT third-party service provider and that may affect the financial entity;

(b) 

identify anomalous activities and behaviour, and implement tools generating alerts for anomalous activities and behaviour, at least for ICT assets and information assets supporting critical or important functions;

(c) 

prioritise the alerts referred to in point (b) to allow for the management of the detected ICT-related incidents within the expected resolution time, as specified by financial entities, both during and outside working hours;

(d) 

record, analyse, and evaluate any relevant information on all anomalous activities and behaviours automatically or manually.

For the purposes of point (b), the tools referred to in that point shall contain the tools that provide automated alerts based on pre-defined rules to identify anomalies affecting the completeness and integrity of the data sources or log collection.
EULAW Article 23 3.
Financial entities shall protect any recording of the anomalous activities against tampering and unauthorised access at rest, in transit and, where relevant, in use.
EULAW Article 23 4.

Financial entities shall log all relevant information for each detected anomalous activity enabling:

(a) 

the identification of the date and time of occurrence of the anomalous activity;

(b) 

the identification of the date and time of detection of the anomalous activity;

(c) 

the identification of the type of the anomalous activity.
  • NOREA -

    EN: DORA in Control Framework of NOREA, the Dutch professional association of IT auditors, https://www.norea.nl/. © NOREA. Reproduced with the permission of NOREA; converted into the GRCA format. Only the version published by NOREA is authoritative.

    DE: DORA in Control Framework von NOREA, dem niederländischen Berufsverband der IT-Auditoren, https://www.norea.nl/. © NOREA. Wiedergabe mit Genehmigung von NOREA; in das GRCA-Format umgewandelt. Maßgeblich ist allein die von NOREA veröffentlichte Fassung.