| Auditing and logging are key components of any security architecture. It is essential that security personnel know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify a network element that has been configured improperly. Mechanisms, such as a signed hash using asymmetric cryptography, must be used to protect the integrity of the audit tools used for audit reduction and reporting.
Protection of audit tools is not a function of DNS. |
