Logblog: Improving Logs for Evidence

« Don't Ever Find Yourself In This Position! | Main | PCI Updates Coming »

Improving Logs for Evidence

We had a great webcast today with top ecommerce lawyer Ben Wright. He offers his top ten strategies on how to proactively improve the admissibility of log data for evidenciary purposes.

Ben's Ten Steps to Immutable Logs

1 - Process and Control - Document how logs are created, stored and protected to increase admissibility in legal cases.

2 - Retention - Keep logs as long as business records AND for at least 6 months

3 - Define log collection - Leave no logs behind! You CAN collect 100% of logs with LMI.

4 - Unaltered records - Separate out collection, storage and processing.

5 - Improve log data with a time and date stamp.

6 - Prevent alteration or loss of log data with secure transport and storage policies.

7 - Establish a clean and clear chain of custody of log data.

8 - Turn logs into an efficient and valuable asset by centralizing the core data set.

9 - Distributed processing and storage strategy is recommended by FBI for best evidence.

10 - Automate alerting and reporting to establish authenticty of logs and establish admissibility.