The importance of repudiation and its role in security
Your logging subsystem may be crucial in giving you early indicators of compromise. By using anomaly detection, you can trigger alerts when something unusual is taking place that needs investigation. By feeding all of your logs into a central log server or a Security Information and Event Management (SIEM) system, you can configure rules that will trigger these alerts when certain conditions hold true. In the event of a security incident, log information can be of the utmost importance because it can help you determine what happened, how it happened, when it happened, and what was affected. The benefits of this are as follows:
- It will allow you to perform a root-cause analysis
- It will help you remediate the cause to reduce the risk that it will happen again in the future
- It may be a requirement that you inform anyone affected by the incident
- Logs may be needed as evidence if this was malicious activity
