2 cissp ® Official Study Guide Eighth Edition

 Log Reviews 
In Chapter 16, “Managing Security Operations,” you will learn the importance of storing 
log data and conducting both automated and manual log reviews. Security information 
and event management (SIEM) packages play an important role in these processes, auto-
mating much of the routine work of log review. These devices collect information using 
the syslog functionality present in many devices, operating systems, and applications. 
Some devices, including Windows systems, may require third-party clients to add syslog 
support. Administrators may choose to deploy logging policies through Windows Group 
Policy Objects (GPOs) and other mechanisms that can deploy and enforce standard policies 
throughout the organization. 
Logging systems should also make use of the Network Time Protocol (NTP) to 
ensure that clocks are synchronized on systems sending log entries to the SIEM as well 
as the SIEM itself. This ensures that information from multiple sources has a consistent 
timeline. 
Information security managers should also periodically conduct log reviews, particularly 
for sensitive functions, to ensure that privileged users are not abusing their privileges. For 
example, if an information security team has access to eDiscovery tools that allow search-
ing through the contents of individual user fi les, security managers should routinely review 
the logs of actions taken by those administrative users to ensure that their fi le access relates 
to legitimate eDiscovery initiatives and does not violate user privacy. 
Network flow (NetFlow) logs are particularly useful when investigating 
security incidents. These logs provide records of the connections between 
systems and the amount of data transferred.

---

Implementing Security Management Processes 
689