OWASP #9: Security Logging and Monitoring Failures

📋 What Is It?

Security Logging and Monitoring Failures occur when insufficient logging and monitoring allow breaches to go undetected, significantly delaying incident response. Without proper logging, attacks are invisible and forensics are impossible.

#9 OWASP Rank

206 Avg Days to Detect

6.51% Max Incidence

⚠️ Common Exploits

Undetected Attacks: Breaches go unnoticed for months
Missing Audit Trails: No record of security events
No Alerting: Suspicious activity not flagged
Log Tampering: Attackers delete/modify logs
Insufficient Detail: Logs lack context for investigation
No Centralized Logging: Scattered, inaccessible logs

🔴 Attack Flow

1. Attacker attempts 1000+ login failures
↓
2. No logging of failed attempts
↓
3. Eventually gains access via brute force
↓
4. Exfiltrates data over weeks
↓
5. BREACH: Discovered months later!

❌ Vulnerable Code

// Bad: No logging of security events
@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    
    if check_credentials(username, password):
        return success()
    
    # Failed attempt NOT logged!
    return error("Invalid credentials")

// Bad: No monitoring of sensitive operations
@app.route('/admin/delete_user')
def delete_user(user_id):
    # Critical action not logged!
    database.delete_user(user_id)
    return "User deleted"

// Bad: Logs stored locally only
# Attacker can delete logs easily
                

✅ Secure Code

// Good: Comprehensive security logging
import logging
from datetime import datetime

logger = logging.getLogger(__name__)

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    ip_address = request.remote_addr
    
    if check_credentials(username, password):
        logger.info(
            f"Successful login: user={username}, ip={ip_address}"
        )
        return success()
    
    # Log failed attempt with details
    logger.warning(
        f"Failed login: user={username}, ip={ip_address}, "
        f"time={datetime.now()}"
    )
    
    # Alert on multiple failures
    if get_failed_attempts(ip_address) > 5:
        logger.critical(f"Brute force detected: ip={ip_address}")
        send_security_alert(ip_address)
    
    return error("Invalid credentials")

// Good: Audit trail for sensitive operations
@app.route('/admin/delete_user')
@admin_required
def delete_user(user_id):
    admin_user = get_current_user()
    
    # Log who did what, when
    logger.info(
        f"User deletion: target={user_id}, "
        f"admin={admin_user.id}, time={datetime.now()}"
    )
    
    database.delete_user(user_id)
    return "User deleted"

// Good: Centralized, tamper-proof logging
# Send logs to SIEM system (e.g., ELK, Splunk)
# Use write-once storage for logs
                

✓ Prevention Checklist

Log all authentication events (success/failure)
Log access to sensitive data
Log administrative actions
Include context: user, IP, timestamp, action
Use centralized logging (ELK, Splunk)
Implement real-time alerting
Retain logs for at least 90 days
Protect logs from tampering (write-once)
Monitor for unusual patterns
Regular log review and analysis

🔍 Detection & Tools

SIEM Tools:

ELK Stack Splunk Graylog Azure Sentinel

Log Libraries:

Python logging Winston (Node) Log4j Serilog (.NET)

How to Test:

Check if failed logins are logged
Verify sensitive actions create audit logs
Test if logs include enough context
Confirm logs are sent to central system

🌍 Real-World Breaches

Target (2013): Breach undetected for weeks despite security alerts being ignored
Equifax (2017): Attackers accessed systems for 76 days before detection
Marriott (2018): Breach went undetected for 4 years (2014-2018)
Yahoo (2013): Breach not discovered until 2016 - 3 billion accounts affected

📌 Quick Tips

DO NOT ignore security logs
DO NOT store logs only locally
DO log all authentication events
DO implement real-time alerting
DO use centralized logging (SIEM)

📜 Compliance

Related Standards:

PCI-DSS Requirement 10 (Logging)
GDPR Art. 33 (Breach Notification)
HIPAA § 164.312 (Audit Controls)
NIST 800-53 AU Family
SOC 2 CC7.2

📊 Security Logging & Monitoring Failures