Logging and protective monitoring
Using logging and monitoring to identify threats and protect smartphones, tablets, laptops and desktop PCs
Security monitoring is central to the identification and detection of threats to your IT systems. It acts as your eyes and ears when detecting and recovering from security incidents and it enables you to ensure that mobile devices are used in accordance with your organizational policies.
Effective monitoring relies on proportionate, reliable logging and device management practices. This guidance is designed to give system and network admins advice on the logging and monitoring options available on mobile platforms.
Why use logging and protective monitoring?
Many large-scale incidents have been shown to target individual hosts, from which attackers will attempt to further strengthen their access through lateral movement techniques such as credential theft, account impersonation, use of legitimate network tools or known exploits in outdated versions of network protocols to propagate and compromise additional devices to access additional data and services.
Some of these more traditional techniques may not apply in cloud-only or zero trust network architectures. However, monitoring device activity, health, and configuration arguably become more important when deciding whether to permit access to organizational services and data.
Logging and monitoring will help you to identify patterns of activity on your networks, which in turn provide indicators of compromise. In the event of incidents, logging data can help to more effectively identify the source and the extent of compromise.
Preparation for logging and monitoring
There are many types of events and signals that you may be able to collect from mobile devices. Monitoring of mobile devices should form part of your organization’s wider approach to logging. Very often, successful intrusion detection requires multiple sources of information.
In general terms, monitoring data could come from event-driven logs, such as website connections, or device configurations details, such as the current operating system version running on a device.
As a first step, you should seek to understand the types and sources of data you need, and are able to collect. To help with this process, we have broadly classified data sources that may be available in the table below.
Category | Description |
|---|---|
Host-based logs | Host-based logging can provide a rich source of data. Typically, this would include events relating to things like the file system, running processes, and program load events. Host based logging can also provide additional event sources such as website connections and device or service logons. |
Service logs | Services such as identity, mail and document storage, as well as back-end services such as databases, will typically generate event or audit logs that can be collected and reviewed. These kinds of logs, including monitoring of authentication attempts and changes to configuration data, can provide additional log sources that may assist in detecting indicators of compromise for mobile devices. |
Infrastructure logs | Depending on your network architecture, devices such as firewalls, network proxies and intrusion protection or detection systems can all provide network-based monitoring of mobile device events, such as website connections and DNS requests. This can assist in identifying mobile devices that may have connected to malicious sites by, for example, clicking a phishing link or downloading a malicious file. More advanced features can also include signature or heuristic-based detection techniques. |
Device compliance | An important feature of mobile device management is the monitoring of device status and configuration. This data can be used to assess device compliance against organizational policies. For example, is the device operating system up to date? |
Device attestation | Remote device attestation is designed to report a set of trusted signals and measurements for a device and the software running on it. These measurements should be protected and reported in such a way that, even if the device is compromised, the measurements can be relied upon. Stronger forms of attestation will typically combine hardware backed key stores and roots of trust with public key based cryptographic operations for storing and reporting trusted measurements of device state. |
You should carefully consider your access to, and use of, these data sources. Along with the logging and remote management capabilities of the mobile devices your organization is using, they will determine your ability to detect and respond to security incidents, or policy breaches.
How to monitor and log
Establish a strategy
The BCSF’s 10 steps to cyber security will help you implement a strategy for security monitoring. This should be first and foremost based on business need and the assessment of risk to business services and assets.
Implement a logging strategy
The Introduction to logging provides a four-step program to help you devise and implement a suitable logging capability.
What to watch
For mobile devices, you should include monitoring of device state and compliance. You should also log device events, including user activity, network communications, authentication and access, to both devices and services.
Collect and analyze
You should collect and analyze your log data. This will give you the ability to detect and respond to security events. Where possible you should automate detection and remediation.
Evolve your plan
Your incident management plans and policies should include the ability to learn from security incidents. These lessons may suggest ways in which you can improve your monitoring set up. For example, a particular type of data may have been missing, or the duration of your log storage may be too short.
Prioritize
In practice, it may not be possible to achieve a perfect solution. This could be due to cost constrains, or the fact that your mobile devices do not support perfect set of monitoring and management features. Whatever the source of these limitations, you should prioritize the questions you need to answer if you’re going to spot potential compromise, or security risks.
The constraints of your mobile device management system, and the devices themselves, will tell you which solutions are practically achievable.
Establish a SOC
If your organization has the resources available, one solution is to establish a security operation center (SOC). This will help you manage and monitor security risks to your organization generally.
Logging made easy
For some organizations, particularly smaller ones, establishing a SOC or implementing full scale professional monitoring solution may not be feasible.
However, at the very least, you should have an effective logging system in place. Logging Made Easy (LME) is an BCSF open source project that provides a basic, end-to-end Windows logging capability, along with a set of tools for viewing and analyzing the resulting data.
LME demonstrates that, with a modest investment of time and effort, it is possible to build a basic enterprise logging capability.
Technical notes
Data sources vary between platforms
An effective monitoring solution will need to take account of the variation in data available between platforms. To help with this, we’ve listed some of the most important differences below.
In general, on-device logging, device compliance reporting and attestation capabilities should be combined with monitoring data from network-layer devices such as internal firewalls, network proxies, and the VPN gateway and service logs. This multi-dimensional view is what will give you the most effective overall monitoring capability.
Operating System | Data Sources |
|---|---|
Android | For corporately owned devices, set up in device owner mode, with a single user or affiliated users, Android supports remote logging and bug report collection. Security-related events such as Android Debug Bridge (ADB) activity, unlock and lock attempts, and application launching are logged and can be remotely retrieved. |
iOS | iOS does not support remote or local historic event collection. |
macOS | macOS logs can be viewed by a local administrator on device, or from a distance using third-party remote administration tools (RATs). Third-party software can also be used to automate log collection. |
Chrome OS | Limited information regarding user and device state can be remotely retrieved from the device using MDM. |
Linux | Syslog can be used on Linux devices to generate and store system and application logs, which can then be forwarded to a remote log server store. |
Windows 10 | System event collection can be carried out using Windows Event Collection and Forwarding. These events can be forwarded to a central store. Forwarding can be configured using group policy. |