log-entity-actions-pattern

# Log Entity Actions Security Pattern Records entity actions to create an audit trail, enabling accountability, non-repudiation, incident investigation, and security monitoring. ## Problem Addressed **Entity repudiates action request**: An entity denies having performed an action, or there's no way to determine what actions occurred, who performed them, or when. ## Core Components | Role | Type | Responsibility | |------|------|----------------| | **Entity** | Entity | Performs actions that should be logged | | **System** | Entity | Processes entity requests | | **Logger** | Entity | Records actions to log store | | **Log Store** | Storage | Persists log entries | | **Log Monitor** | Entity | Analyzes logs for anomalies | ### Data Elements - **action**: The operation performed - **principal**: Identity of entity performing action - **timestamp**: When action occurred - **outcome**: Success/failure status - **context**: Additional relevant information ## What to Log ### Security-Relevant Events - Authentication attempts (success and failure) - Authorization decisions (grants and denials) - Access to sensitive data - Administrative operations - Security configuration changes - Session events (creation, termination) ### Per-Event Information - **Who**: Principal/user identifier - **What**: Action performed - **When**: Timestamp (synchronized, preferably UTC) - **Where**: Source (IP, location, system) - **Outcome**: Success, failure, error - **Context**: Relevant parameters (without sensitive data) ## What NOT to Log **Never log:** - Passwords or credentials - Session tokens - Encryption keys - Full credit card numbers - Personal data beyond necessity - Sensitive business data ## Security Considerations ### Log Integrity - Protect logs from tampering - Detect unauthorized modifications - Consider append-only storage - Sign or hash log entries ### Log Confidentiality - Logs may contain sensitive information - Restrict access to authorized personnel - Encrypt logs at rest and in transit ### Log Availability - Ensure logging system resilience - Handle logging failures gracefully - Don't let logging failures stop business operations - Alert on logging system issues ### Centralized Logging - Aggregate logs from multiple sources - Enables correlation and analysis - Protects against local log tampering - Use secure transmission to central store ### Log Retention - Define retention periods - Meet compliance requirements - Secure deletion when expired - Archive for long-term storage if needed ### Time Synchronization - Use NTP for consistent timestamps - Critical for correlating events across systems - Include timezone information (prefer UTC) ## Logging Flow ``` Entity → [action] → System System → [log(action, principal, timestamp, outcome)] → Logger Logger → [store] → Log Store Log Monitor → [analyze] → Log Store Log Monitor → [alert] → Security Team (if anomaly) ``` ## Implementation Guidelines ### Log Format - Use structured format (JSON, key-value) - Consistent schema across systems - Include correlation IDs for request tracing ### Log Levels - ERROR: Security failures requiring attention - WARN: Suspicious but not definitively malicious - INFO: Normal security events - DEBUG: Detailed troubleshooting (not in production) ### Performance - Asynchronous logging to avoid blocking - Buffer and batch writes - Monitor logging overhead ### Monitoring and Alerting - Real-time analysis for critical events - Threshold-based alerts (e.g., failed logins) - Pattern detection for attack identification ## Common Security Events to Log | Event | Log Level | Details to Include | |-------|-----------|-------------------| | Login success | INFO | principal, source IP, timestamp | | Login failure | WARN | attempted user, source IP, failure reason | | Authorization denied | WARN | principal, action, resource | | Admin action | INFO | principal, action, target, parameters | | Security config change | INFO | principal, what changed, old/new values | | Session timeout | INFO | principal, session duration | ## Implementation Checklist - [ ] All authentication events logged - [ ] All authorization denials logged - [ ] Sensitive operations logged - [ ] No credentials in logs - [ ] Timestamps synchronized (NTP) - [ ] Logs protected from tampering - [ ] Log access restricted - [ ] Retention policy defined - [ ] Monitoring/alerting configured - [ ] Secure transmission to central store ## Related Patterns - Authentication (events to log) - Authorisation (events to log) - Data validation (events to log) ## References - Source: https://securitypatterns.distrinet-research.be/patterns/02_02_001__log_entity_actions/ - OWASP Logging Cheat Sheet - OWASP Security Logging Vocabulary