| Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what was attempted to be done, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network element. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple network elements to acquire a clear understanding as to what happened or is happening. In order to correlate, time stamps are needed on all of the log records. Furthermore, the various components within the network infrastructure providing the log records must have their clocks synchronized using a common time reference so the events can be correlated in exact order of time. This requirement is applicable to network device management and is not applicable to the routing function. |
