A09:2025 - Security Logging and Alerting Failures
Inability to detect, escalate, and respond to breaches due to insufficient logging.
Intent & Description
'
🎯 Intent
Enable effective detection, escalation, and response to security incidents through comprehensive logging and monitoring.
📋 Context
Without sufficient logging and monitoring, breaches cannot be detected. Most breach studies show time to detect a breach is over 200 days. Insufficient logging allows attackers to further attack systems undetected.
💡 Solution
Log all authentication, access control, and server-side input validation failures. Ensure logs are in a format suitable for log management solutions. Establish effective monitoring and alerting. Create an incident response plan.'
Real-world Use Case
📌 TL;DR
Log security events comprehensively. Monitor for anomalies, alert on failures, and maintain incident response plans.
Advantages
- Enables breach detection
- Supports incident response
- Provides forensic evidence
- Meets compliance requirements
Disadvantages
- Log storage costs can be significant
- Excessive logging impacts performance
- Requires trained staff to monitor