| Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what was attempted to be done, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network element. Denied traffic must be logged. There may also be some instances were a packet that was permitted or other successful event (i.e., logon) should be logged to establish and correlate the series of events leading up to an outage or attack. This requirement is applicable to network device management and is not applicable to the routing function. |
