Are all log generators configured to securely transmit logs to your organization's centralized logging infrastructure?
Explanation
Secure, centralized logging is what reviewers want to confirm, namely that every log-generating system, application, and device is configured to transmit its logs safely to a central infrastructure. Secure log transmission typically involves encrypted connections (TLS/SSL), authentication mechanisms, and proper access controls to prevent tampering or interception during transit.
Evidence could include configuration documentation showing how log generators are set up to securely transmit logs, network diagrams illustrating the secure log collection architecture, or output from monitoring tools that verify successful and secure log transmission from various sources to the central logging system.
Implementation Example
Configure log generators to securely share their logs with the organization's logging infrastructure systems and services
ID: PR.PS-04.251
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Log records are generated and made available for continuous monitoring
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
