Skip to main content

CCC.Core.C09: Ensure Integrity of Access Logs

Control ID:CCC.Core.C09
Title:Ensure Integrity of Access Logs
Objective:Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.
Control Family:
Data

Related Threats

IDTitleDescriptionExternal MappingsCapability MappingsControl Mappings
CCC.Core.TH07Logs are Tampered With or DeletedTampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.
1
1
0
CCC.Core.TH09Runtime Logs are Read by Unauthorized EntitiesUnauthorized access to logs may expose valuable information about the system's configuration, operations, and security mechanisms. This could jeopardize system availability through the exposure of vulnerabilities and support the planning of attacks on the service, system, or network. If logs are not adequately sanitized, this may also directly impact the confidentiality of sensitive data.
1
1
0

Related Capabilities

IDTitleDescription
CCC.Core.F03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.

Guideline Mappings

Reference IDEntry IDStrengthRemarks
NIST-CSF
PR.DS-6
0
-
NIST_800_53
AU-9
0
-
CCM
LOG-02
5
Audit Logs Protection (security and retention)
CCM
LOG-04
5
Audit Logs Access and Accountability (Restrict audit logs access to authorized personnel)
CCM
LOG-09
5
Log Protection (protects audit records from unauthorized access)

Assessment Requirements

IDDescriptionApplicability
CCC.Core.C09.TR01When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.
tlp-clear
tlp-green
tlp-amber
tlp-red
CCC.Core.C09.TR02When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.
tlp-clear
tlp-green
tlp-amber
tlp-red
CCC.Core.C09.TR03When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.
tlp-amber
tlp-red