Wombat

WAF-SEC-160 – Security-relevant logs MUST be centrally collected and protected against tampering

Pillar: Security | Severity: 🟠 High | Category: Logging Monitoring | Automatable: High

Description

All authentication, authorization, data access, and administrative activity logs MUST be forwarded to a central SIEM or log platform. Log integrity MUST be ensured by write-once storage, cryptographic hashing, or immutable retention. Forwarding MUST be configured so that logs cannot be disabled or altered at the source without triggering an alert. Retention periods MUST meet compliance and forensic requirements.

Rationale

Risk Description

Risk

Locally stored logs can be deleted or modified by attackers to hide evidence of compromise.

Risk

Missing centralized log correlation prevents timely detection of multi-stage attacks.

Requirements

  • All authentication, authorization, data access, and administrative activity logs MUST be forwarded to a central SIEM or log platform.

  • Log integrity MUST be ensured by write-once storage, cryptographic hashing, or immutable retention.

  • Forwarding MUST be configured so that logs cannot be disabled or altered at the source without triggering an alert.

  • Retention periods MUST meet compliance and forensic requirements.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-sec-160.tf.aws.cloudwatch-logs-retention

Engine: terraform | Provider: aws | Automated: Yes

Security-relevant CloudWatch log groups must have explicit retention

Security-relevant CloudWatch log groups must have explicit retention

Scope: resource — aws_cloudwatch_log_group

Assertions: * retention_in_days greater_than_or_equal 365 — Security log group retention must be at least 365 days.

Remediation: Security-relevant CloudWatch log groups must have explicit retention

Compliant
# Example compliant with waf-sec-160.tf.aws.cloudwatch-logs-retention
Non-Compliant
# Example non-compliant with waf-sec-160.tf.aws.cloudwatch-logs-retention

waf-sec-160.tf.aws.s3-log-integrity

Engine: terraform | Provider: aws | Automated: Yes

Central log S3 buckets must have versioning or object lock enabled

Central log S3 buckets must have versioning or object lock enabled

Scope: resource — aws_s3_bucket, aws_s3_bucket_versioning, aws_s3_bucket_object_lock_configuration

Assertions: * versioning.status equals Enabled — Central log bucket must have versioning enabled.

Remediation: Central log S3 buckets must have versioning or object lock enabled

Compliant
# Example compliant with waf-sec-160.tf.aws.s3-log-integrity
Non-Compliant
# Example non-compliant with waf-sec-160.tf.aws.s3-log-integrity

waf-sec-160.tf.azurerm.log-analytics-sku

Engine: terraform | Provider: azurerm | Automated: Yes

Azure Log Analytics workspace for security logs must define retention

Azure Log Analytics workspace for security logs must define retention

Scope: resource — azurerm_log_analytics_workspace

Assertions: * retention_in_days greater_than_or_equal 365 — Security log retention must be at least 365 days.

Remediation: Azure Log Analytics workspace for security logs must define retention

Compliant
# Example compliant with waf-sec-160.tf.azurerm.log-analytics-sku
Non-Compliant
# Example non-compliant with waf-sec-160.tf.azurerm.log-analytics-sku

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls

  • WAF-SEC-080

  • WAF-SEC-090

  • WAF-SEC-100

  • WAF-OPS-050

  • WAF-SUS-110

  • WAF-SOV-110 == Regulatory Mapping

  • ISO 27001:2022: A.8.15 – Logging, A.8.16 – Monitoring activities

  • CIS Controls v8: CIS 8 – Audit Log Management

  • PCI DSS v4.0: Req 10 – Log and monitor access to network resources and cardholder data

  • SOC 2 Type II: CC7.2 – System monitoring, CC4.1 – Monitoring activities

  • GDPR: Art. 32 – Security of processing, Art. 33 – Personal data breach notification

  • NIS2: Art. 21(2)(f) – Incident handling

  • DORA: Art. 12 – ICT-related incident reporting

  • EUCS (ENISA): MON-01 – Logging and monitoring

  • BSI C5:2020: OPS-05 – Logging and monitoring

  • NIST SP 800-53: AU-6 – Audit Review, AU-9 – Protection of Audit Information