CCC.C09: Prevent Tampering, Deletion, or Unauthorized Access to Access Logs
Objective:Access logs should always be considered sensitive.
Ensure that access logs are protected against unauthorized
access, tampering, or deletion.
Control Family:
Data
Threats:
| ID | Title | Description |
|---|---|---|
| CCC.TH07 | Logs are Tampered With or Deleted | Logs may be tampered with or deleted due to inadequate access controls, or misconfigurations. This can make it difficult to identify security incidents, disrupt forensic investigations, and affect the accuracy of audit trails. |
| CCC.TH09 | Logs or Monitoring Data are Read by Unauthorized Users | Unauthorized access to logs or monitoring data may expose valuable information about the system's configuration, operations, and security mechanisms. This could allow for the identification of vulnerabilities, enable the planning of attacks, or hinder the detection of ongoing incidents. |
| CCC.TH04 | Data is Replicated to Untrusted or External Locations | Data may be replicated to untrusted or external locations if replication configurations are not properly restricted. This could result in unintended data leakage or exposure outside the organization's trusted perimeter. |
NIST CSF:
PR.DS-6
Control Mappings
CCM:
LOG-02
LOG-04
LOG-09
ISO_27001:
NIST_800_53:
AU-9
Test Requirements
CCC.C09.TR01:When access logs are stored, the service MUST ensure that
access logs cannot be accessed without proper authorization.
TLP:
tlp_amber
tlp_red
tlp_green
tlp_clear
CCC.C09.TR02:When access logs are stored, the service MUST ensure that
access logs cannot be modified without proper authorization.
TLP:
tlp_amber
tlp_red
tlp_green
tlp_clear
CCC.C09.TR03:When access logs are stored, the service MUST ensure that
access logs cannot be deleted without proper authorization.
TLP:
tlp_amber
tlp_red
tlp_green
tlp_clear