The National Security Agency (NSA) has published a guide titled “Best Practices for Event Logging and Threat Detection,” focusing on cloud services, enterprise networks, mobile devices, and operational technology (OT) networks. This guide aims to ensure the reliability of critical systems.
The Cybersecurity Information Sheet (CSI), created in collaboration with international partners like the Australian Signals Directorate’s Australian Cyber Security Centre (ASD ACSC), provides guidance for IT and cybersecurity professionals. Its purpose is to help organizations defend against attackers who utilize living off-the-land (LOTL) techniques. Additionally, it offers recommendations for enhancing an organization’s resilience to current cyber threats, taking into account potential resource limitations.
Key Recommendations for Event Logging and Threat Detection
An effective event logging system should be capable of identifying cybersecurity incidents, such as changes to critical software configurations, generating alerts when these occur, monitoring account compliance, and ensuring that logs are both efficient and accessible.
When implementing best practices for logging, consider these four key areas:
- Enterprise-Approved Event Logging Policy
- Centralized Event Log Access and Correlation
- Secure Storage and Log Integrity
- Threat Detection Strategy
Developing an Enterprise Logging Policy for Cybersecurity
Establishing a logging policy that is approved at the enterprise level enhances an organization’s ability to detect malicious activities and ensures a consistent logging approach across all environments. The policy should outline shared responsibilities between the organization and its service providers and should specify which events need to be recorded, how logs will be monitored, how long they will be retained, and when to reassess the importance of certain logs.
Critical elements of an effective logging policy include:
- Quality of Event Logs: Focus on capturing high-quality cybersecurity events rather than merely well-structured logs. High-quality logs enable network defenders to identify and respond to incidents more accurately.
- Detailed Logs: Ensure that logs contain essential information such as timestamps, event types, device identifiers, IP addresses, user IDs, and commands executed. This data is crucial for effective threat detection and incident response.
- Operational Technology Considerations: In OT environments, consider the limited logging capabilities of devices and use supplementary sensors or out-of-band communications to avoid overloading the devices.
- Consistency: Use structured log formats (like JSON) and uniform timestamps (preferably UTC with ISO 8601 formatting) across all systems to facilitate better log correlation and analysis.
- Log Retention: Ensure logs are kept long enough to aid in incident investigations, considering that some threats may remain undetected for months. Retention periods should align with regulatory requirements and the organization’s risk assessment.
Centralized Access and Correlation of Event Logs
Centralizing log collection and correlation helps prioritize log sources for enterprise networks, OT systems, cloud platforms, and mobile devices. The NSA suggests that organizations establish centralized logging facilities, such as secured data lakes, to aggregate logs for better analysis.
To create an effective logging policy:
- Define Responsibilities: Clearly delineate logging roles between the organization and its service providers.
- Prioritize Logs: Focus on critical systems, network devices, and high-risk areas in enterprise, OT, cloud, and mobile environments.
- Ensure Log Quality: Capture crucial details like timestamps, IP addresses, and user IDs, and use consistent formats like JSON.
- Centralized Monitoring: Collect logs in a centralized location, categorizing data into ‘hot’ (quick access) and ‘cold’ (long-term storage) tiers.
- Retention and Storage: Set retention periods based on risk and compliance needs, ensuring sufficient storage to avoid data loss.
- Timestamp Synchronization: Use a reliable, consistent time source across all systems (preferably UTC).
- OT Considerations: Account for OT device limitations by using alternative logging methods.
- Regular Review: Periodically reassess the relevance of logs and update policies as needed.
By following these practices, organizations can strengthen their ability to detect, investigate, and respond to cybersecurity incidents, improving overall compliance.
Secure Storage and Log Integrity
- Centralized Logging: Implement a secured data lake for log aggregation, preventing loss due to limited local storage, and forward critical logs to SIEM/XDR tools for analysis.
- Secure Transport and Storage: Use TLS 1.3 and cryptographic techniques to secure logs during transit and storage. Limit access to sensitive logs.
- Prevent Unauthorized Access: Protect logs from tampering or deletion by unauthorized actors, and ensure only authorized personnel have access, with audit logs in place.
- Harden SIEM: Isolate SIEM systems from general IT environments, filter logs to prioritize critical ones, and reduce costs.
- Baseline and Threat Detection: Use centralized logs to detect deviations from normal behavior that may indicate cybersecurity incidents.
- Timely Log Ingestion: Ensure quick log collection to enable prompt detection of security incidents.
Strategies for Detecting Relevant Threats
To counteract LOTL techniques, organizations should employ user and entity behavioral analytics (UEBA) and utilize SIEM systems to identify anomalies by comparing event logs against established baselines. Key strategies include:
- Behavioral Analytics: Use UEBA to automatically detect unusual behavior on networks, devices, or accounts, which is crucial for identifying LOTL techniques that blend in with normal operations.
- Case Study – Volt Typhoon: This group uses LOTL techniques such as PowerShell scripts and Windows Management Instrumentation Console (WMIC) to infiltrate systems, making traditional detection methods challenging.
- Anomalous Behavior Indicators: Watch for unusual login times, access to unfamiliar services, high volumes of access attempts, and other suspicious activities.
- Enhanced Detection: Deploy endpoint detection and response (EDR) solutions, ensure detailed logging, and establish baselines for legitimate tool usage.
- Proactive Threat Hunting: Regularly conduct threat hunts to identify and address potential LOTL activities, refining detection rules based on evolving threats.
Implementing these strategies helps organizations detect and mitigate LOTL techniques, which can be difficult to identify due to their reliance on legitimate tools and activities within a network.
“Organizations must bolster their defenses against living off the land techniques prevalent in today’s cyber threat landscape,” said Dave Luber, NSA Cybersecurity Director. “Effective event logging enhances system security and resilience by enabling better network visibility and faster incident response.”
