Question 2
Audit Trails
Audit trails maintain a record of system activity both by system and application
processes and by user activity of systems and applications. In conjunction with appropriate tools
and procedures, audit trails can assist in detecting security violations, performance problems, and
flaws in applications. This bulletin focuses on audit trails as a technical control and discusses the
benefits and objectives of audit trails, the types of audit trails, and some common implementation
issues.
Security Objectives
Intrusion Detection
Intrusion detection refers to the process of identifying attempts to penetrate a system
and gain unauthorized access. If audit trails have been designed and implemented to record
appropriate information, they can assist in intrusion detection. Although normally thought of as
a real-time effort, intrusions can be detected in real time, by examining audit records as they are
created (or through the use of other kinds of warning flags/notices), or after the fact (e.g., by
examining audit records in a batch process).
Security
Companies should not use audit trails only to prepare for the worst-case scenario but
rather as additional protection for their organization or business. Monitoring users' activities,
specifically concerning sensitive data, means that they cannot misuse the information. They
know that any misuse or breach can be traced back to them, and that's why they are more vigilant
when dealing with this data. Nowadays, QR code scams are also arising, so be sure to read and
avoid them.
Individual Accountability
Audit trails are a technical mechanism that help managers maintain individual accountability.
By advising users that they are personally accountable for their actions, which are tracked by an
audit trail that logs user activities, managers can help promote proper user behavior. Users are
less likely to attempt to circumvent security policy if they know that their actions will be
recorded in an audit log.