4 ms·
No mention of shipping off logs to another place? It's probably good to assume someone will gain access and make after-the-fact forensics a primary concern as w
by supakeen 8y ago
No mention of shipping off logs to another place? It's probably good to assume someone will gain access and make after-the-fact forensics a primary concern as well.
Something a lot of hardening guides seem to skip!
- Someone1234 8y agoA lot of hardening guides skip the long tail for security. Which is to say: So you've shipped logs off, so then what? How are you going to monitor those regularly, what are you looking for, how are you going to make sure important information stands out? Many people set up remote logging and then never check the logs until after there is an issue. An unread log isn't useful. Logs that are too spammy aren't going to be read.
- imthenachoman 8y agoGood idea. I need to figure out how to work that in into the guide. I added to the to-do list. Thanks!