Insufficient Logging & Monitoring
Insufficient Logging & Monitoring
Insufficient logging and monitoring allows attackers to persist longer, leading to devestating data exfiltration and destruction. Look for:
- Poor integration between logging and incident response.
- Not logging login attempts, login failures, and high-value transactions.
- No monitoring of log files.
- Log messages are unclear or too broad to be useful.
