Infrastructure Security · IS-Q05

Question: Are infrastructure logs consistently generated, retained, and protected from tampering?

  1. Objective — Why This Matters
    Logs are the forensic trail of accountability. Without consistent logging and retention, incident reconstruction and legal defensibility collapse.

  2. Maturity Levels (0 – 5)

0 — Unaware
No logging standards or retention policy.
1 — Ad Hoc
Some systems log locally; no centralization.
2 — Defined
Central syslog server collects key sources.
3 — Managed
Structured logs; daily review; access controls applied.
4 — Integrated
Immutable storage and SIEM correlation.
5 — Optimized
Automated retention, WORM storage, and behavior analytics.
  1. How to Level Up
From → To Actions
0 → 2 Deploy central syslog collector.
2 → 3 Standardize log formats (JSON); set review cadence.
3 → 4 Enable WORM retention; integrate with SIEM.
4 → 5 Add analytics and tamper alerts.

  1. People / Process / Technology Enablers
    People – SOC Analyst, Infra Admin.
    Process – Log review SOP, retention policy.
    Technology – Rsyslog, Loki, OpenSearch, MinIO WORM.

  2. Evidence Required
    Log retention policy, sample central logs, access audit.

  3. Metrics / KPIs
    • percentage of critical systems sending logs centrally
    • number of unauthorized log access attempts
    • average time to detect log anomalies

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Central logging Rsyslog / Fluent Bit + Loki Lightweight log aggregation.
Storage MinIO WORM / SeaweedFS Immutable archival.
Analytics Grafana / OpenSearch Dashboards Visualization and alerting.

  1. Common Pitfalls
    Logs retained locally; deletion or overwrite without backup.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.15 / A.8.28.
NIST CSF 2.0 DE.CM-1 / PR.PT-1.
CERT-In 2022 Log retention 90 days + review.
NIRMATA Scoring IS-Q05 ≥ Level 4 requires immutable central storage.