F. of Repudiation
We log changes and deletions of personal data, but viewing is not logged.
|
Threat |
|
|
|
You may not want your colleagues to know where you live, your phone number, or your salary. However, this information is written to logs that they have access to. |
|
CAPEC |
N/A |
|
ASVS |
1.8.1 - Ensure all your data is given a classification. 1.8.2 - Ensure you have requirements for each classification of your data for each category of the CIA triad (confidentiality, integrity, and availability). 7.1.2 - Ensure PII and other sensitive data being logged comply with regulations. 7.3.3 - Ensure logs are protected by strict access controls and that the entries are immutable. 8.3.5 - Ensure you have an audit trail for all sensitive data access. |
