Viranomaisen on huolehdittava, että sen tietojärjestelmien käytöstä ja niistä tehtävistä tietojen luovutuksista kerätään tarpeelliset lokitiedot, jos tietojärjestelmän käyttö edellyttää tunnistautumista tai muuta kirjautumista. Lokitietojen käyttötarkoituksena on tietojärjestelmissä olevien tietojen käytön ja luovutuksen seuranta sekä tietojärjestelmän teknisten virheiden selvittäminen.
Digiturvamallissa tietojärjestelmän omistaja voi vastata tietojärjestelmän lokitietojen keräämisen tarkastamisesta. Organisaatio dokumentoi lokien sisällön tarkemmin niissä tietojärjestelmissä, joiden teknisestä ylläpidosta se vastaa itse. Muissa tietojärjestelmissä omistaja tarkistaa yhteistyössä järjestelmätoimittajan kanssa, että tarvittavat lokit kertyvät.
The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:
Organization must describe the baseline of normal behaviour for the use of network and data systems, which is used as a starting point for identifying anomalies.
When defining the baseline, the following must be taken into account:
Monitoring systems must be configured against the baseline to identify anomalous behavior such as:
Käyttäjien ja ylläpitäjien toimintaa seurataan poikkeuksellisen toiminnan havaitsemiseksi. Turvallisuusluokan I tietojen käsittelyssä suositellaan tehostettua poikkeamien havainnointikykyä, painottaen muun muassa tietojenkäsittely-ympäristön käyttäjien ja ylläpitäjien toiminnan seurantaa.
Turvallisuusluokan I tietojen käsittelyssä suositellaan riskiperustaisesti turvallisuusluokkaa II pidempiä säilytysaikoja lokitiedoille (esimerkiksi vähintään 10 vuotta).
Turvallisuusluokan I tietojenkäsittely-ympäristöt ovat tyypillisesti suppeita, koostuen esimerkiksi kaikista verkoista pysyvästi irtikytketyistä päätelaitteista. Toisaalta esimerkiksi 10 vuoden lokikertymän säilyvyys on haastava toteuttaa uskottavasti vain päätelaitteilla, joten tällaisten päätelaitteiden lokienkeräys sekä kerättyjen lokitietojen varmistukset edellyttävätkin yleensä suunniteltua säännöllistä prosessia. Käytännön toteutustapana voi olla esimerkiksi lokitietojen säännöllinen kerääminen irtomedialle, jota käsitellään ja säilytetään sen elinkaaren ajan kuin turvallisuusluokan I tietoa. Lisäksi huomioitava, että mikäli tietojärjestelmän pääsynhallinta tai esimerkiksi toimien jäljitettävyys nojautuu fyysisen turvallisuuden menettelyihin, myös näistä syntyviä tallenteita saattaa olla perusteltua säilyttää ja hallinnoida turvallisuusluokan I mukaisilla menettelyillä.
Turvallisuusluokan II–III tiedon käsittely on rekisteröitävä sähköiseen lokiin, tietojärjestelmään, asiarekisteriin tai tietoon (esimerkiksi dokumentin osaksi). Teemasta on olemassa suositus VM 2021:5: Suositus turvallisuusluokiteltavien asiakirjojen käsittelystä.
TL III ja TL II käsittely-ympäristöissä vaatimus voidaan siten, että toteutetaan alla mainitut toimenpiteet:
Tilanteissa, joissa on tarve tuoda tietoa ei-luotetuista järjestelmistä jotain muistivälinettä käyttäen, huomioidaan lisäksi yleensä turvallisuusluokasta II lähtien myös muistivälineen kontrolleritason räätälöinnin uhat.
Kaikki tiedon sisääntuonnin ja ulosviennin käyttötapaukset on tunnistettu. Turvalliset toimintatavat on määritetty, ohjeistettu ja valvonnan piirissä. Turvallisten toimintatapojen piiriin sisältyy tarvearviointi järjestelmien USB-porttien ja vastaavien liityntöjen käytölle.
USB-porttien ja vastaavien liityntöjen käytön tapauskohtaisiin ehtoihin voi sisältyä esimerkiksi, että järjestelmään voi kytkeä vain erikseen määritettyjä luotettavaksi todennettuja muistitikkuja (ja vastaavia), joita ei kytketä mihinkään muuhun järjestelmään. Tapauskohtaisiin ehtoihin voi sisältyä esimerkiksi järjestely, jossa vain organisaation tietohallinnon jakamia muistivälineitä voidaan kytkeä organisaation järjestelmiin, ja että kaikkien muiden muistivälineiden kytkeminen on kielletty ja/tai teknisesti estetty.
Tilanteissa, joissa on tarve tuoda tietoa ei-luotetuista järjestelmistä jotain muistivälinettä käyttäen, tapauskohtaisiin ehtoihin sisältyy usein myös määrittelyt siitä, millä menetelmillä pienennetään tämän aiheuttamaa riskiä. Menetelmänä voi esimerkiksi olla ei-luotetusta lähteestä tulevan muistivälineen kytkeminen eristettyyn tarkastusjärjestelmään, jonne siirrettävä tieto siirretään, ja josta siirrettävä tieto viedään edelleen luotettuun järjestelmään erillistä muistivälinettä käyttäen.
Organisaatio on tunnistanut lokitietojen keräämiseen liittyvät vaatimukset ja varmistanut niiden perusteella lokitietojen keräämisen ja seurannan riittävyyden.
Lokitiedot tulee kerätä tietojärjestelmän käytöstä ja tietojen luovutuksista, mutta tietojen kerääminen on sidottu tarpeellisuuteen. Jos tietojärjestelmästä luovutetaan rajapintojen tai katseluyhteyden avulla salassa pidettäviä tietoja tai henkilötietoja, tulee luovuttavassa järjestelmässä kerätä luovutuslokitiedot sen varmistamiseksi, että tietojen luovuttamiselle on ollut laillinen perusteensa. Lisäksi käyttölokitiedot tulee kerätä ainakin tietojärjestelmistä, joissa käsitellään henkilötietoja tai salassa pidettäviä tietoja.
When utilizing cloud-based data systems, the organisation should request information from the service provider to find out monitoring capabilities of each system.
When offering cloud services as a service provider, the organisation should provide monitoring capabilities and related documentation proactively to the customer. This includes e.g. capability to monitor if the service is being used as a platform or a vector to attack others or capability to monitor for data leaks in the service.
The organization shall have pre-planned, clear policies for each of the different security systems for situations where logging or other access controls are suspected of failing. These situations must be reported to the appropriate and responsible party without delay.
The process must take into account at least the security systems relevant to the organisation's digital security (e.g firewalls, IDS / IPS, anti-malware, access control).
Synchronizing clocks between different systems allows for good interoperability, as well as easier tracking of problem situations and perception of event flows.
An organization must use a reliable source to adjust and synchronize time, at least for systems that are critical to its operations. When suitable organization should use two sources.
The organization has to technically make sure that logs are in read-only state for all users who have write-privileges - including admin rights.
Removing logging or editing them can only be possible through carefully considered policies, which ensure segregation of duties, and when needed, break glass style emergency measures.
When implementing a management process, the organization should consider a centralized log management system and SIEM-integration for real time monitoring.
Lokeja suojataan luvattomilta muutoksilta ja häiriöiltä (esim. tietojen muokkaaminen tai säilytyskapasiteetin ylittyminen) mm. seuraavin toimintatavoin:
The logs are protected from unauthorized changes to the data and from malfunctions, which are e.g.:
The organization must be aware of the logs that accrue from the use of different data systems, whether generating the logs is the responsibility of the organization or the system provider. Logs record user actions as well as anomalies, errors, and security incidents.
The adequacy of log should be reviewed regularly. If necessary, log should be usable to determine the root causes for system incidents.
Often, security tools provide a way to set alert policies when something potentially dangerous happens in an organization's environment. For example, Microsoft 365 has built-in alert policies to alert you to abuse of administrator privileges, malware, potential internal and external risks, and data security risks.
The organization must identify security-related events in data systems and the environments in which they operate. To respond to changes related to these events, alarm policies must be created.
Alarm policies need to be actively monitored and modified based on experience.
Security systems (e.g. firewall, malware protection) often have the ability to record a log of events. At regular intervals, make sure that a comprehensive log is accumulated and try to identify suspicious activity. The log is also useful in investigating disturbances or violations.
The organization must have a procedure for reviewing event logs for rule violations and other noticeable problems with in compliance with legal and organizational provisions.
The organization should also protect the integrity of the event logs (e.g. by separate environment).
Organization should use tools that support both manual and automated searches, including criteria-based searches. The tool should be able to automatically collate data from different sources to more easily determine whether an incident is genuine, as well as its scope and nature.
These operations and processes can be implemented with SIEM (Security information and event management). SIEM solutions use analytics tools, technology and algorithms (e.g., newer SIEM solutions employ applied machine learning) to help detect unknown threats and abnormalities in the security-relevant data. Also SIEM solutions allow organizations to modify already existing (which usually come pre-configured) and add criteria-based alerts to match known threats. These things will help detect threats earlier.
Use a standardized log format. This simplifies integration between logs and third-party log analysis tools, making it easier and, in some cases, even possible.
The organization must log admin and security logs from used devices and services.
These logs record actions taken by system administrators and privileged users. They help monitor changes to system configurations, user access rights, and other critical settings. By keeping these logs, an organization can audit administrative activities and ensure accountability.
Security logs capture events related to the security of systems and data. This includes login attempts, firewall activities, intrusion detection system alerts, and antivirus actions. Monitoring these logs helps identify suspicious activities that could indicate a security breach or an internal threat.
Continually assess whether the collected data, both security-relevant monitoring data and obtained threat information from relevant sources, is sufficiently relevant and detailed.
Only relevant monitoring data should be collected and preserved, and if necessary, reconfigure the monitoring in line with the strategy. All collected data which no longer has operational or security relevance should be removed.
Organisation must identify which laws and regulations it needs comply with. Based on these laws and regulations, the organisation determines a strategy and guidelines for data logging and analysis.
The following things should be described in the strategy and guidelines:
Organisation must identify which laws and regulations it needs comply with. Based on these laws and regulations, the organisation determines a strategy and guidelines for data logging and analysis.
The following things should be described in the strategy and guidelines:
Organization should use tools that support both manual and automated searches, including criteria-based searches. The tool should be able to automatically collate data from different sources to more easily determine whether an incident is genuine, as well as its scope and nature.
These operations and processes can be implemented with SIEM (Security information and event management). SIEM solutions use analytics tools, technology and algorithms (e.g., newer SIEM solutions employ applied machine learning) to help detect unknown threats and abnormalities in the security-relevant data. Also SIEM solutions allow organizations to modify already existing (which usually come pre-configured) and add criteria-based alerts to match known threats. These things will help detect threats earlier.
Organization should use tools that support both manual and automated searches, including criteria-based searches. The tool should be able to automatically collate data from different sources to more easily determine whether an incident is genuine, as well as its scope and nature.
These operations and processes can be implemented with SIEM (Security information and event management). SIEM solutions use analytics tools, technology and algorithms (e.g., newer SIEM solutions employ applied machine learning) to help detect unknown threats and abnormalities in the security-relevant data. Also SIEM solutions allow organizations to modify already existing (which usually come pre-configured) and add criteria-based alerts to match known threats. These things will help detect threats earlier.
Continually assess whether the collected data, both security-relevant monitoring data and obtained threat information from relevant sources, is sufficiently relevant and detailed.
Only relevant monitoring data should be collected and preserved, and if necessary, reconfigure the monitoring in line with the strategy. All collected data which no longer has operational or security relevance should be removed.
The organization employs process for addressing unauthorized assets, utilizes automated tools for asset discovery, conducts weekly reviews to identify discrepancies, implements access denial measures for unauthorized assets, and maintains clear protocols for asset removal, with all actions being logged and documented.
The organization shall use DHCP logging:
The organization utilizes automated software inventory tools that are deployed across the enterprise to continuously monitor and document installed software.
The organization generates regular reports and alerts enforcing compliance through automated checks to ensure only authorized software is installed.
The organization automates session locking on enterprise assets by configuring general-purpose operating systems to lock after 15 minutes of inactivity and mobile devices after 2 minutes.
Organization utilizes centralized policy management tools to enforce these settings and educates users on the importance of locking sessions.
The organization secures enterprise assets and software by utilizing Infrastructure-as-Code (IaC) for consistent configuration management
Organization employs secure network protocols like SSH and HTTPS for administrative access, and avoids insecure management protocols and augmenting them with additional security when necessary
The organization adapts asset inventory documentation practices to include pertinent details such as the department owner, review date, and account purpose.
The organization conducts regular reviews of data system access rights and validates that all active service accounts are authorized. An owner is assigned for each service account, drawing from the practice of listing data system owners, who are tasked with completing the necessary documentation and security actions.
The organization has developed a detailed process for audit log management, specifying logging requirements, collection, review, and retention procedures.
Organization ensures compliance with standards, conducts annual reviews and updates, and continuously monitors these processes for adherence and issue resolution.
The organization implements a comprehensive system for collecting and securely storing command-line audit logs from interfaces like PowerShell® and BASHTM, and integrated remote terminal logging, and established regular reviews to monitor user activities and identify potential anomalies.
The organization implements comprehensive audit logging for sensitive data assets, capturing detailed event information, configuring systems for log richness, regularly updating logging configurations, and ensuring secure storage of audit logs for robust security oversight and analysis.
The organization enables detailed audit logging for sensitive data assets, capturing comprehensive forensic details, optimizing configurations for thoroughness, securely storing logs centrally, and regularly reviewing practices to align with evolving security and investigative needs.
The organization equips systems with up-to-date logging software to capture URL requests, defines criteria for logging based on risk and regulations, routinely reviews logs for anomalies, enforces access controls and integrates logging with SIEM systems to boost threat detection and incident response.
The organization implements a centralized log management system to
The organization establishes integrations with service provider platforms to automate the collection of logs related to key events like authentication and user management, uses automated processes to routinely gather these logs and configures filters to capture relevant data.
The organization establishes a whitelist for approved browsers and email clients, utilizing automated version control and regular compliance checks to ensure up-to-date, authorized software use and implements centralized IT management to restrict installations.
The organization configures group policies to disable autorun and autoplay across all systems, employs endpoint protection software for additional control, provides user training on safe media practices, and establishes a formal policy outlining media use rules.
The organization enhances backup security by implementing offline storage solutions, deploying cloud-based isolated backup environments, utilizing off-site facilities, and maintaining a version-controlled backup process. Regular audits ensure backup integrity, while a dedicated network for backup operations minimizes threats and secures data transmission and storage.
The organization enforces a VPN authentication policy requiring all users to authenticate before accessing corporate resources, integrates multi-factor authentication (MFA), deploys client certificates for enhanced security and regularly updates VPN software.
The organization fortifies security by choosing a compatible host-based intrusion detection system (HIDS), configured for comprehensive monitoring and alerting, with regularly updated signatures and rules. The HIDS is deployed on critical assets, periodically reviewed and tuned for accuracy, and integrated with centralized logging and management systems for efficient incident analysis and response.
The organization enhances security by selecting and implementing a suitable host-based IPS or EDR solution, deploying it on critical assets, and ensuring regular updates for threat signatures and rules.
The organization adopts trusted security libraries, utilize platform-provided features, implement standardized encryption, leverage OS audit logging, integrate IAM services, regularly update security components, and train developers on best practices to ensure robust application security.
Anomalies must be reported to the relevant parties in order to develop the following activities:
Organization's data systems and network must be monitored to detect abnormal use. When anomalities are detected, the organization must take the necessary measures to assess the possibility of security incident.
The monitoring should utilize tools that enable real-time or regular monitoring, taking into account the organization's requirements. Monitoring practices should be able to manage large amounts of data, adapt to changing threat environment, and send alerts immediately when necessary.
Inclusion of the following sources in the monitoring system should be considered:
li>
Organization must also establish procedures for identifying and correcting "false positive" results, including tuning monitoring software for more accurate anomaly detection.
Vulnerabilities in third-party or open source libraries must be monitored, scanned, and reported in the same style as other vulnerabilities.
The organization must define policies to identify required updates in applications that use external libraries. Surveillance scans can be automated with specialized tools.
It also makes sense for an organization to monitor overall communication about vulnerabilities.
The organization must have pre-planned, clear policies for situations where logging or other access controls are suspected of failing. These situations should be reported to the appropriate authority without delay.
Different types of situations should have their own policies. Monitoring errors can be caused by software errors, log saving errors, log backup errors, or memory overflows.
The organization must have the ability to monitor and report on actions related to encryption and encryption key management.
When abnormal activity is detected it must be handled in accordance with incident management processes.
By monitoring the amount of information shared in cloud services, efforts can be made to identify risks that could lead to unauthorized disclosure of information. With respect to files one may e.g. monitor:
System logs often contain a wealth of information, much of which is irrelevant to security monitoring. In order to identify events relevant to security monitoring, consideration should be given to automatically copying appropriate message types to another log or to using appropriate utilities or audit tools to review and resolve files.
Security systems are the data systems that are in place to protect the information we have, not so much to process it.
We regularly evaluate the operation of different security systems and the need for new systems.
The necessary personnel are regularly trained in the use of selected security systems.
Archive and sign logs digitally at regular intervals to ensure log integrity.
The organization should collect logs from all of it's assets. The collection should be done according to organization's log management process.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
