| It is critical that when a network device is at risk of failing to process audit logs as required, action is taken to mitigate the failure. If the device were to continue processing without auditing capabilities, the firewall or the network could be compromised without logged information available for incident traceback.
Some firewall attacks try to generate specific traffic to fill up the logs. Sudden saturation of the log may be an indication of a network attack. However, shutting down the firewall, the network's first line of protection against attack, because of a log failure is not a good best practice. Sudden system shutdown must generate a real-time alert; however that requirement is covered by another control. |
