Home >> Taxonomy >> Asvs 4.0.3 >> 07 error handling and logging >> 03 log protection

Log Protection

V7.3.1

Verify that all logging components appropriately encode data to prevent log injection. (C9)

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 117

V7.3.2

[DELETED, DUPLICATE OF 7.3.1]

Level 1 required: False

Level 2 required: False

Level 3 required: False

CWE:

V7.3.3

Verify that security logs are protected from unauthorized access and modification. (C9)

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE: 200

V7.3.4

Verify that time sources are synchronized to the correct time and time zone. Strongly consider logging only in UTC if systems are global to assist with post-incident forensic analysis. (C9)

Level 1 required: False

Level 2 required: True

Level 3 required: True

CWE:

Disclaimer:

Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.

View source on GitHub

Loading comments 0%