Log Management: Using Computer and Network Records to Improve Information Security

Published

October 25, 2006

Author(s)

Shirley M. Radack

Abstract

NIST SP 800-92 helps organizations develop, implement and maintain effective processes for managing logs, which contain information about specific events occurring within information technology (IT) systems and networks. The information is recorded in logs by the systems¿ software and applications, and can be used by organizations to improve the security of their operations. The bulletin discusses how sound log management practices can support the overall security of an organization¿s systems and information. Topics covered include basic information about computer security logs, the usefulness of these logs, and the challenges of managing them. Recommendations for effective log management involve: the components of the log management infrastructure, including the hardware, software, networks, and media that are used to generate, transmit, store, analyze, and dispose of log information; the planning processes that enable the organization to carry out consistent, reliable, and efficient log management practices; and the operational processes that aid organizations in successfully managing logs.

Citation

ITL Bulletin -

NIST Pub Series

ITL Bulletin

Pub Type

NIST Pubs

Download Paper

Local Download

Keywords

Computer security, information security, information technology, log management, policies, security incidents, security software

Citation

Radack, S. (2006), Log Management: Using Computer and Network Records to Improve Information Security, ITL Bulletin, National Institute of Standards and Technology, Gaithersburg, MD, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=50913 (Accessed April 30, 2024)