4 ms·
You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs
by tatersolid 8y ago
You need IP addresses for forensic investigation. As the statute of limitations for most forms of fraud is 10 years or more, shouldn’t everyone be storing logs with full IPs and source ports for at least that long?
- pmlnr 8y agoNo, it wouldn't make any sense, and an IP address is a very bad measurement as well. Think of airports, public hotspots, etc - even if you do keep the data, nothing else will be kept that log (or at lease I believe at this point in time), so what would storing the IP get you? An approximate location of a now potentially already recycled device and nothing else, really.
- tatersolid 8y agoIf you have a log time stamp, IP and source port of a compromise, you at least have a chance at attribution by working with the source network operator who can potentially correlate to a MAC or subscriber. The police can even pull video of a coffee shop to see who was there during an attack. Without the time stamp and IP information you have zero chance at attribution during a security event. PCI and a bunch of other regs require log retention for 1 year or even more for this reason.