Which control protects the integrity of event logs on a logging system?

Which control protects the integrity of event logs on a logging system?

• A. Users must be authenticated for access.
• B. The logging system is mirrored in a remote data center.
• C. Log changes are administered under dual control.
• D. Event logs are stored on a shared network drive.

Answer: (C)

The correct answer focuses on the principle of dual control, which adds a layer of security around the management of event logs. Dual control requires that two or more individuals are involved in the process of making changes to log files. This mechanism helps prevent unauthorized modifications and maintains the integrity of the event logs by ensuring that any changes are verified and agreed upon by multiple parties. Integrity of event logs is critical for auditing and forensic analysis, as these logs provide a record of events that can be vital in understanding security incidents. By administering log changes under dual control, organizations can minimize the risk of insider threats and accidental data corruption, ensuring that the log data remains accurate and trustworthy. The other options, while they may contribute to the overall security posture, do not specifically address the direct integrity of event logs in the same effective manner. User authentication helps ensure that only authorized personnel access the logs, but it does not prevent those authorized users from making unauthorized changes. Mirroring logs in a remote data center provides redundancy but does not inherently protect the logs from being altered. Storing logs on a shared network drive does not provide safeguards against unauthorized changes, making it less secure for maintaining the integrity of the logs.

The correct answer focuses on the principle of dual control, which adds a layer of security around the management of event logs. Dual control requires that two or more individuals are involved in the process of making changes to log files. This mechanism helps prevent unauthorized modifications and maintains the integrity of the event logs by ensuring that any changes are verified and agreed upon by multiple parties.

Integrity of event logs is critical for auditing and forensic analysis, as these logs provide a record of events that can be vital in understanding security incidents. By administering log changes under dual control, organizations can minimize the risk of insider threats and accidental data corruption, ensuring that the log data remains accurate and trustworthy.

The other options, while they may contribute to the overall security posture, do not specifically address the direct integrity of event logs in the same effective manner. User authentication helps ensure that only authorized personnel access the logs, but it does not prevent those authorized users from making unauthorized changes. Mirroring logs in a remote data center provides redundancy but does not inherently protect the logs from being altered. Storing logs on a shared network drive does not provide safeguards against unauthorized changes, making it less secure for maintaining the integrity of the logs.