4 ms·

Not just IPs, The regulation knows about all of them (including RFID): Preamble paragraph 30: > Natural persons may be associated with online identifiers provi

by TomK32 8y ago

Not just IPs, The regulation knows about all of them (including RFID): Preamble paragraph 30: > Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

pmlnr 8y ago
That's not what I meant, I'm curious why people want to store IPs apart from the security applications, which usually only need it temporarily.
- tatersolid 8y ago
  You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?
  - pmlnr 8y ago
    No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.
    - tatersolid 8y ago
      If you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack. Without the time stamp and IP information you have zero chance at attribution during a security event. PCI and a bunch of other regs require log retention for 1 year or even more for this reason.

4 ms·

Not just IPs, The regulation knows about all of them (including RFID): Preamble paragraph 30: > Natural persons may be associated with online identifiers provi

by TomK32 8y ago

pmlnr 8y ago
That's not what I meant, I'm curious why people want to store IPs apart from the security applications, which usually only need it temporarily.
- tatersolid 8y ago
  You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?
  - pmlnr 8y ago
    No, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.
    - tatersolid 8y ago
      If you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack. Without the time stamp and IP information you have zero chance at attribution during a security event. PCI and a bunch of other regs require log retention for 1 year or even more for this reason.