Re: [logs] log review policies

From: Ralf Hildebrandt (Ralf.Hildebrandt@charite.de)
Date: Thu Oct 18 2001 - 07:45:09 PDT

  • Next message: Nick Vargish: "Re: [logs] log review policies" 

    On Wed, Oct 17, 2001 at 09:45:03PM -0400, peff-loganal@fenris.cc wrote:

> - attacker breaks into mail server
> - attacker deletes logs from mail server
> - admin has no idea that attack occurred

- admin was not running a data intergrity checker like tripwire or aide.
  Uh.

> Clearly, it's more secure to require a physical use of the log box, at

Definitely

-- 
Ralf Hildebrandt                            Tel.  +49 (0)30-450 570-155
                                            Fax.  +49 (0)30-450 570-916
This signature was added just to have one. ;-)



---------------------------------------------------------------------
To unsubscribe, e-mail: loganalysis-unsubscribe@securityfocus.com
For additional commands, e-mail: loganalysis-help@securityfocus.com

    This archive was generated by hypermail 2b30 : Thu Oct 18 2001 - 07:51:41 PDT