2 cissp ® Official Study Guide Eighth Edition

Logging and Monitoring
Logging records events into various logs, and monitoring reviews these events. Combined, 
logging and monitoring allow an organization to track, record, and review activity, provid-
ing overall accountability.
This helps an organization detect undesirable events that can negatively affect confiden-
tiality, integrity, or availability of systems. It is also useful in reconstructing activity after 
an event has occurred to identify what happened and sometimes to prosecute those respon-
sible for the activity.
Logging Techniques
Logging
is the process of recording information about events to a log file or database. Logging 
captures events, changes, messages, and other data that describe activities that occurred on a 
system. Logs will commonly record details such as what happened, when it happened, where 
it happened, who did it, and sometimes how it happened. When you need to find information 
about an incident that occurred in the recent past, logs are a good place to start.
For example, Figure 17.5 shows Event Viewer on a Microsoft system with a log entry 
selected and expanded. This log entry shows that a user named Darril Gibson accessed a 
file named 
PayrollData (Confidential).xlsx
located in a folder named 
C:\Payroll
. It 
shows that the user accessed the file at 4:05 p.m. on November 10.
F I g u R e 17. 5
Viewing a log entry

---

774
Chapter 17 
■
Preventing and Responding to Incidents
As long as the identifi cation and authentication processes are secure, this is enough 
to hold Darril accountable for accessing the fi le. On the other hand, if the organiza-
tion doesn’t use secure authentication processes and it’s easy for someone to impersonate 
another user, Darril may be wrongly accused. This reinforces the requirement for secure 
identifi cation and authentication practices as a prerequisite for accountability. 
Logs are often referred to as audit logs, and logging is often called audit 
logging. However, it’s important to realize that auditing (described later in 
this chapter) is more than just logging. Logging will record events whereas 
auditing examines or inspects an environment for compliance.