SM-01—Audit Logging

>Control Description

Organization logs critical information system activity.

Theme

Technology

Type

Detective

Policy/Standard

Logging & Monitoring Standard

>Implementation Guidance

1. Ensure that the Organization's Logging Standard includes logging requirements for critical system activity. 2. Ensure that the following system logging configurations (at the least, but not limited to) for a selection of production systems to determine the following: a. Log aggregation tool is configured for the service. b. Whether the below logs are being sent to the log aggregation tool: i. System OS logs ii. AWS Config (configuration monitoring resource in AWS) iii. Cloud Trail (All account level activity including API calls, IAM role/user) iv. VPC Flow Logs (Showing all network connections to and from a VPC) v. Guard Duty (AWS provided threat detection service) c. PCI Specific - Whether critical information system activity is logged such as the following: i. Access to all audit trails (Covered through CloudTrail) ii. Invalid logical access attempts. iii. Use of and changes to identification and authentication mechanisms, including: All elevation of privileges. All changes, additions, or deletions to any account with root or administrative privileges. iv. Initialization of audit logs v. Stopping or pausing of audit logs vi. Creation and deletion of system level objects vii. Alerts are in place to be triggered when the aforementioned logs are not forwarded/face an error in being sent by the log aggregation tool.

>Testing Procedure

1. Inspect Organization's Logging Standard to determine whether logging requirements are defined for critical system activity. 2. Inspect system logging configurations for a sample of production systems to determine the following: a. Log aggregation tool is configured for the service. b. Whether the below logs are being sent to the log aggregation tool: i. System OS logs ii. AWS Config (configuration monitoring resource in AWS) iii. Cloud Trail (All account level activity including API calls, IAM role/user) iv. VPC Flow Logs (Showing all network connections to and from a VPC) v. Guard Duty (AWS provided threat detection service) c. PCI Specific - Whether critical information system activity is logged such as the following: i. Access to all audit trails (Covered through CloudTrail) ii. Invalid logical access attempts. iii. Use of and changes to identification and authentication mechanisms, including: All elevation of privileges. All changes, additions, or deletions to any account with root or administrative privileges. iv. Initialization of audit logs v. Stopping or pausing of audit logs vi. Creation and deletion of system level objects vii. Alerts are in place to be triggered when the aforementioned logs are not forwarded/face an error in being sent by the log aggregation tool.