Tietoturvan ja tietosuojan seuranta ja valvonta

The development of system logs must keep pace with the development of the system and enable, for example, the necessary resolution of incidents. In connection with the data system list, we describe for which systems we are responsible for the implementation of the logging. For these systems, we document:

• which data is saved on the log
• how long log data is retained

The organisation must define how regular monitoring of the use of personal data will be carried out (e.g. data can only be viewed and processed by authorized persons) and what will be done in the event of misuse.

The logs are protected from unauthorized changes to the data and from malfunctions, which are e.g.:

• changes to the message types that can be saved
• editing or deleting log information
• exceeding log storage capacity, which can result in transactions being overwritten or not logged

System logs often contain a wealth of information, much of which is irrelevant to security monitoring. In order to identify events relevant to security monitoring, consideration should be given to automatically copying appropriate message types to another log or to using appropriate utilities or audit tools to review and resolve files.