[ISM] Proactive Controls (OWASP Top):

[OWASP] Monitor and log security events (SSS-02-12-09)

Ensure security events are logged and actively monitored to detect and respond to potential threats in real-time. For example, implement detailed security logs for authentication attempts, access control violations, and unusual activities to track potential security incidents; Utilize automated monitoring and alerting systems to identify anomalies and unauthorized access attempts; Store logs securely, ensuring they are tamper-resistant and retained for forensic analysis; Leverage the same logging frameworks used for debugging to integrate security monitoring seamlessly into development and operations workflows; Continuously review and refine logging policies to enhance threat detection and response capabilities.

[OWASP] Establish comprehensive logging and monitoring (SSS-02-12-09-01)

Ensure consistent and secure logging practices across all systems to facilitate monitoring, auditing, and incident response. -Standardize logging formats and frameworks across the organization for consistency. Use tools like Apache Logging Services to unify logging across different programming languages (Java, PHP, .NET, C++). -Balance logging granularity by capturing critical details, such as timestamps, source IPs, and user IDs, while avoiding the logging of sensitive data like usernames or confidential business information unless properly protected. -Ensure time synchronization across all systems and nodes to maintain consistency in timestamps, improving log correlation and forensic analysis. By standardizing logging, capturing essential details securely, and ensuring timestamp accuracy, organizations can enhance security visibility, detect threats efficiently, and improve compliance with logging best practices.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-12-09-01-01	Use a common logging framework	Standardize logging practices across the organization by using a common logging framework, such as Apache Logging Services, to ensure consistency in logs between different systems and technologies (e.g., Java, PHP, .NET, C++).	Development	Security Engineers, Software Developers
SSS-02-12-09-01-02	Log sufficient, but not excessive data	Ensure logs contain essential information such as timestamps, source IPs, and user IDs to help identify potential security incidents. Avoid logging sensitive data like usernames or business-critical information unless extra security measures (e.g., encryption) are in place.	Development	Security Teams, DevOps Teams
SSS-02-12-09-01-03	Synchronize time across nodes	Ensure that all systems within the network are synchronized to a common time source to prevent issues with inconsistent timestamps across logs. This is critical for accurate incident detection and forensic analysis.	Deployment	IT Operations, Security Engineers
SSS-02-12-09-01-04	Implement automated monitoring	Set up automated monitoring systems to analyze security logs in real time, using tools like SIEM (Security Information and Event Management) to detect and alert on potential security incidents.	Post-deployment	Security Teams, IT Operations
SSS-02-12-09-01-05	Ensure secure storage and access to logs	Protect logs from unauthorized access or tampering by storing them securely. Use encryption and access control mechanisms to ensure that only authorized personnel can access or modify security logs.	Post-deployment	Security Engineers, Compliance Officers

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1849) OWASP Proactive Controls OWASP Proactive Controls