Logging Security Standard

April 8, 2016

Purpose

This standard establishes the minimum requirements for collection, storage and review of log information.  

Overview

Logging is needed to identify and respond to unauthorized activities on agency systems. 

Scope

This standard applies to all participating agencies as defined by Iowa Code Chapter 8B.1(7). Non-participating agencies are encouraged to follow this and other enterprise standards. 

Definitions

Selected terms used in the Enterprise Logging Security Standard are defined below: 

• Event: Something that occurs within a system or network.

Enterprise Logging Standard

1. Logging: All servers, network devices, and applications shall be capable of and configured to:
   1. Produce audit logs, and
   2. Offload audit log data to a log aggregation server
2. Events: The following events (successful and failed) shall be captured in audit logs:
   1. Authentication attempts,
   2. Attempts to use a privileged account,
   3. Attempts to change account passwords,
   4. Attempts to modify or destroy a log file, and Attempts to grant, modify, or revoke access rights.
      The following shall be logged for each event:
      1. User/subject identity,
      2. Date and time of the event,
      3. Source of access,
      4. Duration of access,
      5. Actions executed, and
      6. Action result.
3. Applications: Application, including web services and database services, residing on servers that utilize cashed or separate authentication capabilities must also maintain logs of all security, application and event related information. Web applications shall also meet the requirements of Enterprise Web Application Security Standard.
4. Storage: The System Administrator will ensure audit storage capacity is allocated in accordance with system configuration such that capacity is not exceeded.
5. Log Access: Audit records, audit settings, and audit reports shall be protected from unauthorized access, modification, and deletion.
6. Alerts: Where feasible systems shall be configured to provide real-time alerts for the following:
   1. Audit failure.
   2. Escalation of privileges
   3. Five (5) or more consecutive failed authentication attempts.
7. Time Stamps: Systems shall be configured to generate time stamps to include both date and time. The time may be expressed in Coordinated Universal Time (UTC) and utilize Network Time Protocol (NTP) time synchronization.
8. Retention: Audit logs shall be retained for a minimum of 45 days. Maximum log retention shall be set to meet agency contractual requirements.
9. Review: Audit logs shall be reviewed at least weekly. Alerts shall be reviewed daily.
10. Providers: Third party providers shall meet the requirements of this standard.

Updates

This document shall be reviewed at least every two years and updated as needed.

Effective Date

This standard was approved electronically by the CIO on April 8, 2016 and shall be effective May 1, 2016.

Enforcement

This standard shall be enforced pursuant to Iowa Administrative Code11-25.11(8A) and Iowa Code 8B.21(1)(f)(2).

Variance

Iowa Administrative Code 11-25.11(2) and Iowa Code 8B.21(5) provide for variances\waivers from security standards. Requests for a variance\waiver from any of the requirements of this standard shall be submitted in writing to the Chief Information Security Officer.