SM-14—Log-tampering Detection

1. Obtain relevant organizational policy/standard and ensure defined process regarding enabling audit logging and monitoring are adhered to. 2. Validate specific mechanisms to monitor and flag tampering to the audit logging and monitoring tools in the production environment are defined and documented. 3. Validate whether appropriate mechanisms are implemented to protect the integrity of logs and to prevent/detect logs from being modified/tampered at the storage location. Additionally, ensure such activities are recorded and controlled. 4. Inspect whether administrative permissions to manage and modify audit logs are restricted to authorized personnel only. 5. For a sample of events, inspect whether all administrative and operational activities are logged and events are captured to trace back to a particular user in case of any modifications/tampering performed. 6. Validate whether all applicable logs are replicated and stored on a centralized server and access is restricted to only authorized personnel,