4 ms·
Most applications will log ip addresses by default. Why? 1) Many security products rely on IP addresses in order to blacklist known malicious users (including f
by twunde 9y ago
Most applications will log ip addresses by default. Why?
1) Many security products rely on IP addresses in order to blacklist known malicious users (including fail2ban) and/or detect hacking attempts. Monitoring for stolen credentials b also will typically check IP addresses ie why is John showing up as being logged in from an unknown IP address when he's in the office with me? 2) It can be useful for debugging. Are those requests going to the right server? Is there one server where something isn't working correctly ie is that server misconfigured? 3) Some businesses are required to prevent screenscraping of certain data. Solutions to prevent that typically use and store IP address information.
- geofft 9y ago1 can be done by checking but not logging IPs, which we certainly did (we'd tcpdump traffic and throw it in iptables) or logging IPs of malicious requests but not of normal behavior. 2 is what this regulation is intended to stop: you shouldn't be trading off "it might be useful in the future" for "it can be misused by authorized users, or exfiltrated by hackers". 3 seems reasonable, but does that require a retention policy of more than a couple of hours?