Escosio, Julla Agnes C.
BSACC – 3 BLK – 1
Auditing in a Computer Information System Environment
AUDIT TRAIL
Audit trails are records of computer events about the operating systems,
applications, and user activities. A computer system may have different audit trails for
different activities. These audit trails help auditors in the audit of the computer systems
of clients.
USES OF AUDIT TRAIL
Audit trails may be used as:
To support regular system operations
A kind of insurance policy
To support regulatory system operations
Help system administrators protect the system applications from outsiders,
hackers, and unauthorized persons inside organizations and technical problems
To review data after occurring any special event
BENEFITS AND OBJECTIVES OF AUDIT TRAIL
Audit trails provide a lot of security-related benefits which include:
Individual accountability
Every person is liable for his/her actions. Audit trail traces and records all
the activities done by users. Only the authorized person can access the
required resources, which will help save resources from misuse
Reconstruction of events
Help to distinguish operator-induced error and system-created error
Intrusion detection
Helps to identify attempts to penetrate a system and unauthorized access
Problem analysis
Used as an online tool to help identify problems other than intrusions as
they occur. This often referred to as real-time auditing or monitoring
AUDIT TRAIL AND LOGS
There are two types of audit records:
Event oriented logs
Event records should specify when an event occurred, the user’s ID
associated with the event and the command used to initiate the event, and
the result
Keystroke monitoring
It records the keystroke entered data in the computer user
IMPLEMENTATION ISSUES
Audit trail data requires protection, since the data should be available for use when
needed and is not useful if it is not accurate.
Protecting Audit Trail
It should be protected by strong access controls to help prevent
unauthorized access
Data Review of Audit Trail
Audit trail review can be easier if the audit trail function can be queried by
user ID, terminal ID, application name, date and time, or another set of
parameters to run reports of selected information
Audit Trail Review After an Event
Review by the application owner to determine if their
resources are being misused
Periodic Review of Audit Trail Data
Computer security managers should determine how many
reviews of audit trail records is necessary based on the
importance of identifying unauthorized activities
Real-Time Audit Analysis
Audit trails are analyzed in a batch mode at regular intervals
Tools for Audit Trail Analysis
Many types of tools have been developed to help to reduce the amount of
information contained in audit records. Especially on larger files, which
can be extremely difficult to analyze manually. Some of the types of tools
include:
Audit reduction cost
These are preprocessors to reduce the volume of audit
records to facilitate manual review
Trends/Variance detection tools
It looks for anomalies in user or system behavior. It is
possible to construct more sophisticated processors that
monitor usage trends and detect major variations
Attack signature-detection tools
It looks for an attack signature, which is a specific sequence
of events inactive of an unauthorized access attempt
Cost Considerations
Audit trails involve many costs:
System overhead
Human and machine time required to do the analysis
Cost if investigating anomalous events
An audit trail is the complete history or log of any activity being performed on a
document inside Docsvault. These activities can be creation, modification, copying,
moving, deletion, and so forth. Administrators or managers can view the audit log and
identify each step in the process the document goes through.
Highlights
Full audit trail setting allows logging of every activity happening on a file or folder
Users can view the history of events on any file with a simple right-click menu
Administrators and managers can query audit logs using various time, user, and
location criteria
Helps identify steps within the task process that are unnecessary, so that you
can improve the workflow and efficiency of your organization
Reduces chances of manipulation of records and thwarts security breaches
Brief Facts in Audit Trail
Provides a step-by-step history of all activities pertaining to a document
Reliable and easy-to-follow audit trail for better internal control within an
organization
Meet regulatory compliance standards by monitoring and recording activities
occurring in your repository
