How To Maintain And Monitor Audit Logs

Hasan Kismetli
Technical Support Engineer
NNT - New Net Technologies

The coronavirus outbreak has become a real global pandemic affecting hundreds of millions of individuals and organizations across the world. Many governments have advised residents to avoid non-essential social contact and travel, a concept recently coined ‘social distancing’.

For safety reasons, most organizations have also advised their employees to work remotely from home and have taken steps to allow users remote access who would not normally have the ability to do so. With that in place, organizations must consider the consequences in terms of security as their employees will be accessing their internal IT infrastructure to view critical data remotely.

Employees will be exposing the organizations devices to greater risk as they leave the safety and security of the workplace. Many employees do not have a proper security framework at home like they normally do at their organization’s workplace such as firewalls, antivirus software, etc. which can increase the chances of malware finding its way into the internal infrastructure.

Audit Logs

Even with robust security defenses in place in the internal infrastructure, there’s no way to 100 percent guarantee that systems will not be breached. That’s why maintaining, monitoring and analyzing audit logs is so crucial. The Center for Internet Security (CIS) emphasizes the importance of maintaining, monitoring, and analyzing these audit logs in CIS Control 6, the last of the Basic CIS Controls.

The use of the audit policy is needed now more than ever before to help fight against any cyber attacks as audit logs will provide a detail-rich source of security data and remote user activity that can help an organization gain insight into the inner working of their IT environment.

It is very important to get expert advice when it comes to configuring your audit policy on your environment, not only to ensure that you are getting all the audit events needed, but to also avoid generating unneeded events. When it comes to expert advice, NNT can provide you with this as we are partnered with the Center for Internet Security (CIS) and together we provide certified audit policy recommendations that you can implement to ensure detailed auditing is applied with unwanted events being suppressed at the source. Within the auditing section of any CIS guide is a full description of the suggested auditing configuration and the rational on why the system should be configured in this manner.

audit logs

The benefits of configuring auditing are clear and the CIS guides tell us the what and the why but they also cover the how. Each rule within the guides has a remediation note that covers the configuration of the setting on the system.

audit logs

Configuring auditing in your environment would of course be covered by any system hardening activities. We recently published a blog on 5 steps to harden your cloud environment and auditing is an easy starting point for any organization looking to begin their system hardening journey.

The CIS can also help here with the use of the CIS Remediation/Build Kits, pre-configured Group Policies for Windows and a script for Linux that match the suggested configuration of the CIS guidelines.

Remediation/build kits can be used as part of your group policy structure or with your configuration management software of choice for Linux but be mindful, if you only want the audit configuration from the kits you will need to remove the other settings that the kits include. If using the kits on standalone systems is required then this is also possible. All remediation/build kits can be run locally by utilizing the following OS specific approach.

Standalone Windows Server

Steps to apply the auditing section of Microsoft’s local group policy locally.

Download the Local Group Policy Object executable
On the system to be hardened, unzip the NNT provided remediation or build kit
Open a command prompt with administrative privileges
Use the command prompt to run this command to configure the auditing settings of the system:
LGPO.exe /ac "C:\\DomainSysvol\GPO\Machine\microsoft\windows
nt\Audit\audit.csv"
Reboot the system

Standalone Linux Server

Steps to apply the auditing for Linux hardening to a standalone Linux server.

Unzip the remediation or build kit
Edit the script using the CIS guidelines to only contain the auditing commands
Move the .sh file to the system that will be hardened
Provide executable permissions to the .sh script:
# sudo chmod +x NNT CIS Red Hat Enterprise Linux 7 Server Benchmark - Level 1.sh
Run the script:
# sudo NNT CIS Red Hat Enterprise Linux 7 Server Benchmark - Level 1.sh
Reboot the system once the script has finished

Windows systems will need a helping hand due to the lack of a native logging service. Fortunately, any SIEM solution on the market today will have a mechanism of collecting important Windows’ logs via a local agent or through a pull mechanism.

Using a SIEM solution combined with the NNT CIS audit policy templates, you will be able to efficiently gather and centralize logs from all of your devices and applications, allowing you to analyze and spot suspicious activities by mining incoming logs or searching through logs from past weeks and months to build a picture of past activity.

With all the logs being centralized, it’s a good idea to configure your SIEM solution to lookout for the key types of logs. But with so many logs flowing into the system, where do you start? Here we can lean on the various compliance standards as a starting point. If we look at the PCI DSS standard requirement 10, we can see a good description of the type of logs we might want to pick out from the collected logs.

Using this as guidance we can then decide which event types we are looking to collect for posterity and which events will also lend themselves to immediate alert generation.

In conclusion, if you are thinking about how to get started on an audit project now that all of your workforce is remote working for the foreseeable future, please consider the following steps: