Question

1. The CSO for your college has asked you to create a log audit policy. Use NIST and SANS websites to help you build your log policy. Remember to include roles and responsibilities, log storage, disposal and security, and analysis of the data. NIST SP800-92 can be very helpful.

Answer 1

1. Audit credential validation-validate the credentials entered

2. Audit kerberos authentication- check authentication of the users

3. Audit kerberos service ticket-system for the service tickets

4. Audit other account logon event-to see account event logon

5. Audit user account management-check the user management for accounts

6. Audit security group management-check the security group management for any updation

7. Audit plug and play events-check for any plug and play devices connected or events

8. Audit process creation-check all the process that have been created

9. Audit directory service access-check who have access the directory services

10. Audit login and logoff-to check which users have logged in and logged off

11. Audit device access-to check which devices user has used to access the service

12. Audit application and certificate services and generation -check how and where the services have been used and their security services certificate generation

13. Audit file sharing among users-to check where the files have been shared by the users

14. Audit object creation and access.-check the validation of object created and who have accessed it

15. Audit any policy change in regards of security and privacy.-check for any change in policy or any updation regarding the security and privacy sector