Exam 18: Security Auditing

The basic audit objective is to establish accountability for systementities that initiate or participate in security-relevant events and actions.

Windows is equipped with three types of event logs: system event log, security event log, and ________ event log.

A _______ is an independent review and examination of a system's records and activities.

______ software is a centralized logging software package similar to, but much more complex than, syslog.

Windows allows the system user to enable auditing in _______ different categories.

Monitoring areas suggested in ISO 27002 include: authorized access, all privileged operations, unauthorized access attempts, changes to (or attempts to change) system security settings and controls, and __________.

The ________ is a module that transmits the audit trail records from its local system to the centralized audit trail collector.

The foundation of a security auditing facility is the initial capture ofthe audit data.

Severe messages, such as immediate system shutdown, is a(n) _____ severity.

The ________ is a module on a centralized system that collects audit trail records from other systems and creates a combined audit trail.

Applications, especially applications with a certain level of privilege,present security problems that may not be captured by system-level or user-level auditing data.

Although important, security auditing is not a key element in computersecurity.

All UNIX implementations will have the same variants of the syslogfacility.

The ________ is an application or user who examines the audit trail and the audit archives for historical trends, for computer forensic purposes, and for other analysis.

_________ is a form of auditing that focuses on the security of an organization's IT assets.

_________ audit trails are generally used to monitor and optimize system performance.

Data items to capture for a security audit trail include:

A _______ is conducted to determine the adequacy of system controls, ensure compliance with established security policy and procedures, detect breaches in security services, and recommend any changes that are indicated for countermeasures.

Audit trails are different from audit logs.

________ audit trail traces the activity of individual users over time and can be used to hold a user accountable for his or her actions.