April 8, 2009
More organizations are gathering log data from their various systems and network devices for security-tracking purposes, according to the "SANS 2009 Annual Log Management Survey" (PDF).
Nearly 90 percent of the respondents said they collect log data -- a trend that has been on the rise. Nearly 30 percent did not collect logs last year, and 44 percent didn't in 2007, according to SANS.
The top reasons organizations collect log data is for security-event detection -- tracking suspicious behavior and monitoring user activity (around 75 percent); forensic analysis and correlation (nearly 70 percent); operations/process control compliance (nearly 70 percent); and proving regulatory compliance (53 percent). The respondents are using logs from operating systems (92 percent); switch, router, and firewalls (90 percent); databases (57 percent); and database activity monitoring (11 percent). Nearly 50 percent collect log data from their virtual machines.
In past years, the survey found organizations struggled with collecting log data, but according to this year's report, only 4 percent had problems doing so -- a big improvement from 2007, when more than 50 percent did.
Organizations increasingly are integrating log data with their security information event management (SIEM) systems, too, according to the SANS report. More than 30 percent said they are incorporating log management with SIEM, while 26 percent plan to do so.
"The tide has turned. Log management is no longer a toy just for the geeks," wrote report author Jerry Shenk, senior analyst for the SANS Institute and senior security analyst for D&E Communications.
"Over the past two years, our surveys have shown that organizations are realizing the value of log management controls because they know that valuable information exists in log data for security and operations," the report says. "We are also seeing that mature organizations are beginning to use logs for these more advanced purposes."
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Selling Breaches: The Transfer of Enterprise Network Access on Criminal Forums
Defending Corporate Executives and VIPs from Cyberattacks
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report