2. Say if the following statements are True or False.

1) Logger will inevitably cause the disk space exhaustion.

2) An attacker will try to wipe out any traces of his malicious activity.

3) The purpose of a log bypass is to perform malicious activities without being logged.

4) Log tampering is the least serious of the threats to the logging subsystem.

5) There’s no way to completely avoid log overhead.

Vocabulary

3. Find English equivalents of the following phrases in the text.

1) внедрение, установка

2) отказ в обслуживании

3) исчерпать дисковое пространство

4) стереть следы вредоносных действий

5) быть скрытным

6) переполнить системный журнал

7) контрольный журнал

8) возврат каретки

9) непроизводительные издержки

10) группировать

4. Match the words 1-7 with the definitions a-g.

1) utilization a) a prescribed number or quantity

2) persistent b) existing or remaining in the same

state for an indefinitely long time

3) malicious c) to proceed without reference to;

get round; avoid

4) to bypass d) deliberately harmful

5) quota e) an excessive amount

6) to tamper f) to interfere in a harmful manner

7) overload g) the act of using

5. Find the words in the text which have the similar meaning to the words below.

1) important or serious

2) risk or danger

3) to make certain

4) to delete or erase

5) completely, totally

6) incorrect, made-up

7) a meaningful character for a computer program

8) inescapable

9) to improve or enhance

10) capacity, amount

6. Read the text below and choose the best option for each gap. Logging Best Practices

We will list a few miscellaneous best practices for logging. Some of these best practices are critical for the security of the logging subsystem or the application in general while others are defense in (1) ……………. strategies that will enhance the security of the system as a whole.

Configuration Management – It is vital that the logger be tremendously configurable. This includes parameters such as log levels but also the location where the logs will be stored i.e. the log (2) …………. Such paths should never be assumed or hardcoded but should instead be entirely administrator configurable. This will allow for the scenario where a specific administrator might want to store the logs on a (3) ………………. file server.

Archiving – It is important that sufficient safeguards are in place to prevent a log from being filled by (4) ……………. It is therefore important to backup and archive the log files to some offsite storage such as tape backups. These backups must be retained at least for a minimum of six months. Further, these log files should be adequately protected at their archive location as well. Consider the use of cryptographic techniques such as (5) ………….. signatures and encryption. Archived log files can be especially useful in detecting how far back a compromise had started.

Digital Signatures – In applications that have a high security bar and where the audit (6) …………….. is going to be heavily relied on, it is advisable to tamper proof the log files. This can be done by incremental digital signatures that are maintained in a different location.

Multiple Log Files – It is often the most productive to have multiple log files for (7) ……………. applications. One common technique is for each subsystem to have its log file. However, this can often be handled by saving a parameter with each log entry that identifies the subsystem responsible for logging the data. A more effective strategy in practice is to use at least three log files, one for audit trail related logging, one for exceptional conditions and (8) ……………. for general logging. This allows a developer or incident response investigator attempting to debug a problem to view the error or exception in isolation before attempting to gather more context by (9) ………….. the general log.

Logging at Different Layers – It is best to log at every layer of the application that has the (10) …………………. For instance, consider logging at the network boundary, the DMZ (Demilitarized Zone), the web server, the application server, the database server, file servers and so on.

1. a) deep b) depth c) deeper

2. a) basins b) sinks c) bowls

3. a) separate b) single c) remote

4. a) junk b) garbage c) litter

5. a) arithmetical b) numerical c) digital

6. a) trail b) track c) path

7. a) large b) largest c) larger

8. a) other b) another c) either

9. a) using b) use c) usage

10. a) skill b) competence c) capability

7. Look at the following examples from the text:

We will list a few miscellaneous best practices for logging.

This includes parameters such as log levels but also the location where the logs will be stored.

In applications where the audit trail is going to be heavily relied on, it is advisable to tamper proof the log files.

Revise the rule about using ‘will’ and ‘going to’ to express future actions. What is the difference? Give two examples for each form.

8. Using the terms from the unit write a summary of possible logging threats and practices to handle them.