Designing a logging and auditing strategy to support security operations
In the previous chapter, we learned about the key components and areas of focus for architecting a security infrastructure that has proper controls in place and is resilient. Designing and architecting a secure infrastructure is important. However, attackers are constantly searching for vulnerabilities that can be exploited within the infrastructure. To contend with these vulnerabilities and threats to our infrastructure, we should be logging and auditing all activity that takes place on our infrastructure. The design of our logging and auditing strategy becomes the foundation of our company’s security operations center (SOC).
Security operations overview
Before we go into the strategy for logging and auditing, let’s provide context around security operations and a SOC. Security operations is the overall process of using information that has been gathered and analyzing that information for...
