4: Auditing Access Logs

Question 1

Access log contenst

Answer 1

IS auditor needs to determine what events are recorded in access logs.

The IS auditor needs to understand the capabilities of the system being audited and determine if the right events are being logged, or if logging is suppressed on events that should and could be logged.

Question 2

• Centralized access logs

Answer 2

The IS auditor should determine whether the organization’s access logs are aggregated or are stored on individual systems.

Question 3

Access log review

Answer 3

The IS auditor needs to determine if there are policies, processes, or procedures regarding access log review. The auditor should determine if access log reviews take place, who performs them, how issues requiring attention are identified, and what actions are taken when necessary.

Question 4

Access log protection

Answer 4

The IS auditor needs to understand access log protection mechanisms. Primarily, the auditor needs to determine if access logs can be altered, destroyed, or attacked to cause the system to stop logging events.

Question 5

Access alerts

Answer 5

The IS auditor should determine whether automated mechanisms are in place that alert appropriate personnel of security alerts related to access logs.

The IS auditor should determine whether written procedures exist for such events, as well as records of their