Improper Logging Configuration
Overview
Improper logging configuration refers to the incorrect setup or management of logging mechanisms within software or systems, leading to inadequate, excessive, or insecure recording of events. This weakness arises when logs fail to capture necessary information, expose sensitive data, or are not protected against unauthorized access or tampering.
Why It Matters
- Security impact: It can hinder incident detection and response, allow attackers to cover their tracks, or expose sensitive information through logs.
- Business risk: Poor logging can result in compliance violations, loss of forensic evidence, and increased recovery time after security incidents.
- Common consequences: Data breaches, undetected intrusions, and failure to meet regulatory requirements.
Where It Appears
- Environments: Web applications, enterprise systems, cloud infrastructures, and network devices.
- Systems or processes: Authentication systems, transaction processing, error handling, and audit trails.
- Typical conditions: Default logging settings, misconfigured log levels, unencrypted log storage, and insufficient access controls.
How It Is Exploited (High Level)
Attackers exploit improper logging by manipulating or deleting logs to evade detection, accessing sensitive information stored in logs, or leveraging incomplete logs to obscure malicious activities.
How It Is Addressed (High Level)
Mitigation involves implementing secure logging practices such as ensuring comprehensive and relevant event capture, protecting log integrity and confidentiality, enforcing access controls, and regularly reviewing logging configurations and logs.
Related Topics
Audit logging, log injection, insufficient logging and monitoring, security information and event management (SIEM), data leakage, compliance auditing.