log

Anton is on a plane to California. Thanks to modern technology - scheduled posting - he just posted his take on how not doing application logging.

If you are into software development, you might find his insights to very useful.

Data integrity is one of the building blocks of security. The others are availability and confidentiality. 

Many of the people I meet are not security professionals. For them to understand the importance of integrity, I use examples.  Until recently, that was the only way to get any interest in the topic. Now, thanks to regulations and corporate governance, integrity seems to get more attention also from the management side of things. But still it seems to be hard to grasp the importance of it.

I admit that integrity of logs are important. IMO, they are mostly important to the technical side of things, and to the auditors. Unless of course you get caught red-handed one day, then the managers will find integrity of the log to be important too.

 ---

The managers I meet usually has their focus on business. Creating revenue, maximizing profit, lowering cost of operation. For them to see the value of integrity, you need to focus on their everyday life. Focus on their tasks, and relate the integrity to that. What will it do to you if you no longer can make sense of the CRM system? How can you manage your team if you no longer trust the information at hand? 

For exec managers it is easier to see the value of being compliant. But my experience shows that also at this level the true value is created by relating it to their everyday tasks. What happens if you can no longer trust the financial reports?  What if the information at hand is wrong and manipulated, but you do not know? If you suspect errors in the data, how can you make sure there are non (or find out how they came about?)

Trusting your information is key. If you cannot trust it, what value does it have to you? Speculating can only do you so good. Knowing is always better.

Rob is not making me pull my hair off today - he has a very good summary of integrity. It uses good examples and focus on different solutions and discusses the issues each solution rises.