CISA, FBI, NSA release guidance on event logging for cyberthreat mitigation; document outlines best practices to improve organizational resilience

The Cybersecurity and Infrastructure Security Agency Aug. 21 published guidance providing best practices for event logging to mitigate cyberthreats. The document was developed with the FBI, National Security Agency and multiple international cybersecurity agencies. The guide provides recommendations designed to improve organizational resilience in the current cyberthreat environment. 
 
"In the current cyberthreat environment, understanding your network and everything attached to it is critical," said Scott Gee, AHA deputy national advisor for cybersecurity and risk. "Quality log data helps in building a comprehensive picture of your environment, drives detection and alerting systems to discover issues quickly, and helps incident responders understand what went wrong if you do suffer a cybersecurity incident. This document provides guidance on 'implement(ing) an event logging policy focused on capturing high-quality cyber security events to aid network defenders in correctly identifying cyber security incidents.' 
 
"Ideally, logs should be stored for a period of one year, subject to storage space constraints. In the middle of an incident is not the time to find out that you were not logging useful data, or that you were not retaining that data for long enough to thoroughly investigate the incident. Within the past year, Microsoft has added additional free log storage for several of their service tiers. The field is reminded that rural hospitals are eligible for free and heavily discounted Microsoft services.” 
 
For more information on this or other cyber and risk issues contact Gee at sgee@aha.org. For the latest threat information and other cyber and risk resources visit www.aha.org/cybersecurity.