Vulnerability Highlight: Beavers, Insufficient Logging and Monitoring

In the world of cybersecurity, a beaver's habits can teach us valuable lessons about the importance of logging and monitoring. While beavers are renowned for their engineering skills, particularly when it comes to building dams with logs, we, too, can learn from their example.

Security Logging and Monitoring failures are in the Top Ten of the OWASP 2021 list, at number 9, but there’s no direct vulnerability that can be exploited. Yet it remains a vulnerability and can be devastating. Those pesky attackers in our systems...undetected...escalating privileges, tampering with data, stealing data. No good. That’s why it’s super important to record system events in real time with proper logging. Be like a beaver. BE THE BEAVER.

A beaver and his SUFFICIENT logging...we could learn a thing or two

“Insufficient logging and monitoring” or a “security logging and monitoring failure” (they mean the same thing) is a security event that wasn’t caught, logged, and monitored quickly enough to ensure a timely response to the incident or breach. Ouch. What is the difference between the two? Logging records actions in the system and allows us to drill down to the root cause of the issue. At the same time, monitoring provides an immediate notification when the problem occurs (or is about to occur).

Beavers' logs in their ecosystems serve as a prime example of the importance of logging. We record errors, unauthorized access attempts, and failed login attempts to identify security threats early on. By doing so, we can prevent significant damage from undetected breaches, which could go undetected for weeks or even months without sufficient logging and monitoring.

What is the point of logging and monitoring? To identify security threats early enough before they blow up in our face, causing significant damage. If we didn’t have sufficient logs and tracking of those logs, it could take days/weeks/months before we even detect a breach of sensitive data. To recap, insufficient logging and monitoring reduce our visibility into incidents, failures, and breaches, and limit our ability to alert. For beavers, their dams break. I guess to a beaver, a dam breach is as bad as a security breach, but what do I know?

What are some of the issues with insufficient logging and monitoring? If an attacker is undetected in our system for some time, who knows what damage they could cause or what data they could steal? If there IS a breach, insufficient logging makes it harder to determine the scope and root cause. Lastly, with limited visibility into system activities, threat hunting becomes even more challenging when proactive. Some examples include missing logs for activities such as authentication attempt failures and unauthorized access. This poor log format can’t be easily interpreted, not monitoring the logs you DO have, and not properly retaining logs to investigate past incidents.

So what’s a beaver, err, a developer to do? Set up good logging.

• Log all critical events, including access control events, errors, and authentication attempts.

• Properly storing the logs in one central location and retaining them for a long enough period of time.

• Monitor logs regularly and set up detection and alerts.

• Frequently conduct security assessments to make sure the logging and monitoring are still sufficient.

By adopting these habits, you'll be well on your way to securing your systems against undetected threats. Remember: proper logging and monitoring are essential for identifying security threats early and preventing damage in the first place.

BE LIKE A BEAVER.

“I will stop this water flow RIGHT NOW. Don’t try me. I will put a log RIGHT HERE.”