Question

The devices designed for the purpose of addressing security in the network generate a number of logs during the continuous monitoring of the network. Discuss in detail the different types of logs created and how the security professional can use this information for analysing security in the network.

Answer 1

The different types of logs created and how the security professional can use this information for analysis security in the network --

• Networks, computers and IT system generates records called logs that document system activity.
• The logs file contains critical information of the business like - user performance, file creation and modification time, user access and adjustment.
• And log files is authentication logs, system logs and audit logs, intrusion detection system and intrusion prevention system logs.
• Logs are composed of log entries and each entry contains information which is relatd to specific event that has occured in the network or system. and the logs in the organization contains record which is related to computer security.
• By using intrusion time, attack patterns and servers can be identified and traced and analyzed by these logs file.
• Logs file are generated through web servers, computing devices and applications.

Types of Logs --

• There are top four types of log data which IT team should follow and moniter and manage regularly --
• 1.) Failed login attampts -- If the user failed to login, it can be red flag that something is wrong. and failed login attempts occur most of the time.
• And if you are noticing many login attempts that have failed, this can be indication of attacker is trying to break into system.
• 2.) Firewall and intrusion dectection devices -- The log from security tools like firewall and intrusion detection devices can contain data security in the organization.
• The firewall is first first wall of security form outside threat
• 3.) Switched and Routers -- All the basic network devices provide log data. you need to identify chain of data through your organization, through firewall, from server, sitches and routers.
• 4.) Application Logs -- Application logs contains robust log capabilities and some use the application log section of windows.
• For example -- If the medical data which is already protected and going through an application then app logs will show the same things that windows logs will show.