Auditing

Question 1

Two requirements for auditing?

Answer 1

Event definition

Event detection

Question 2

What are the three types of audit trail analysis?

Answer 2

Audit trail review after event.

Periodic review of audit trail data.

Real-time audit trail analysis (part of intrusion detection function)

Question 3

What are three ways to protect audit trail data?

Which is most vulnerable to intruder attack? Impractical but permanent? Most secure?

Answer 3

1. Read/write file on host: most vulnerable
2. Write-only device: paper trail, impractical for detailed audits but permanent.
3. Write-once/read-many device: most secure but delayed access.