Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:23 PM
Connect Directly

SANS Survey: Log Data Not 'Just For Geeks' Anymore

More IT/security professionals are collecting log data than ever before, new report says

More organizations are gathering log data from their various systems and network devices for security-tracking purposes, according to the "SANS 2009 Annual Log Management Survey" (PDF).

Nearly 90 percent of the respondents said they collect log data -- a trend that has been on the rise. Nearly 30 percent did not collect logs last year, and 44 percent didn't in 2007, according to SANS.

The top reasons organizations collect log data is for security-event detection -- tracking suspicious behavior and monitoring user activity (around 75 percent); forensic analysis and correlation (nearly 70 percent); operations/process control compliance (nearly 70 percent); and proving regulatory compliance (53 percent). The respondents are using logs from operating systems (92 percent); switch, router, and firewalls (90 percent); databases (57 percent); and database activity monitoring (11 percent). Nearly 50 percent collect log data from their virtual machines.

In past years, the survey found organizations struggled with collecting log data, but according to this year's report, only 4 percent had problems doing so -- a big improvement from 2007, when more than 50 percent did.

Organizations increasingly are integrating log data with their security information event management (SIEM) systems, too, according to the SANS report. More than 30 percent said they are incorporating log management with SIEM, while 26 percent plan to do so.

"The tide has turned. Log management is no longer a toy just for the geeks," wrote report author Jerry Shenk, senior analyst for the SANS Institute and senior security analyst for D&E Communications.

"Over the past two years, our surveys have shown that organizations are realizing the value of log management controls because they know that valuable information exists in log data for security and operations," the report says. "We are also seeing that mature organizations are beginning to use logs for these more advanced purposes."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-17
Adobe Download Manager versions have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
PUBLISHED: 2019-10-17
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
PUBLISHED: 2019-10-17
An issue was discovered in Bitdefender BOX firmware versions before that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupn...
PUBLISHED: 2019-10-17
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
PUBLISHED: 2019-10-17
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.