auditing-security-logging-completeness

Auditing security-logging completeness: whether the record exists when you need it

Detection and forensics can only work with signals the application actually emits. A gate that denies access but writes nothing is invisible after the fact; a privilege change with no audit entry cannot be reconstructed; a log that quietly captures a token or an email address becomes a disclosure store; a log that accepts raw newlines can be forged to hide a trail. This audit is the mirror of the usual hunt: the source is a security-relevant action that must reach an audit sink, or a secret that must never reach a log sink, and the finding is a record that is missing, insufficient, leaking, or forgeable. You do it by enumerating the decisions that matter and following each to whether, and how, it is recorded.

When to use

• You are assessing whether an application produces the security events an investigation would need.
• Authorization denials, authentication, privilege changes, or sensitive reads may go unrecorded.
• Logs may capture secrets or personal data, or accept unneutralized untrusted input.

Scope check

Audit logging and log contents only in systems you own or are authorized to assess, and treat any secrets or personal data you find in logs as sensitive: report their presence, do not copy them out. If you can't name the authorization, stop.

The loop

1. Enumerate the security decisions that should be recorded. Inventory where a security-relevant event happens: authentication attempts and their outcome, authorization denials and sensitive grants, credential and privilege changes, account lifecycle events, and access to sensitive data. This is the set of sources that each need to reach a durable audit sink.

2. Check each decision actually reaches an audit sink. For every one, trace whether it emits a durable, security-relevant record, not just a response to the user. A denial that returns an error but logs nothing, or logs only at a debug level that is off in production, is invisible to an investigation. A decision that fires with no record is the core gap.