“Apart from evading detection for almost 10 months from August 2017, the attacker was conscientious in erasing logs on compromised workstations and servers. Notably, the attacker even re-entered the network after being detected, to erase system and program logs,” the report said.
--
(1) If Central Logger is implemented - then all the system and program logs and security logs will have been copied out to the Central Logger.
Even if the hackers erase the system and program logs and security logs from the compromised servers or clients or network --- it is useless because the Central Logger will have taken possession of all the system and program logs and security logs - which can be used for forensics and analysis.
(2) If SIEM (Security Incident and Event Management) System is deployed - hacking incidents and anomalies will have been detected and correlated - and actions can be immediately taken to stop the attack --- without the needs for staff to correlate suspicious activities.
No comments:
Post a Comment