[Autogenerated] We know that criminals like to remove traces of their
activity from the audit logs so they can't be detected,
and that will also hamper forensic investigations.
And so requirement 10.5 is all about protecting the integrity of
audit trails on the core of the requirement here.
Demands the audit trails are in PC terms secured so they can't be altered.
There are five.
Some requirements have to be fulfilled.
The testing procedure for the first four of the five sub
requirements is the same that the QoS a will look at
system settings and permissions.
On also interview the system administrators on the first
of the log integrity sub requirements.
10.5 of requirements is to restrict read access of
the logs to people who need it.
So making sure that as basically with everything in the c.
D.
You've got role based access with least privilege
based on the need to know basis.
Requirement 10.5 point two just appears to be a restatement of
the Maintain 20.5 requirement to protect all that log files
from unauthorized modifications.
But like so many things in Requirement 10,
the actual details in the testing procedure again,
which I've added.
Here in the purple text,
the QoS is going to look to see what logical and
physical access controls are in place.
Now we have to be careful with 10.5 point three to make sure
we don't take a too literal interpretation.
What the standard wants is for the log files to exist on a system that's
separate from the system that generated the log files.
So the use of the word back up here is a bit confusing.
Remember, the standard is quite old,
and so it was written when it wasn't common to automatically have
systems right there logs to central log collectors.
So if you do that already, if you write your log files to central log collectors,
you could ignore this requirement.
If you don't,
then you need to copy the log files from the system that generated
it to another system because the actual back But retention of log
files is part of requirement 10.7.
It's also important that where we think of this word back up here,
it's not that it's saying that backups have to be proven to be immutable,
just difficult to alter on again,
10.5 point four predates the general way that companies consolidate logs today,
an explicit calls error blog far as generated by externally facing devices to
be written to internal servers so that the log files error not directly
accessible if the external facing devices compromised.
The last of the sub requirements concerned with the
integrity of log files is 10.5 point five,
which asked for file integrity,
monitoring or or any change detection mechanism to
detect an alert on changes in log files.
Now this could be problematic because, of course,
log files change all of the time because they're constantly being written to.
So this could be a tricky requirement to Azure fulfill.
And often we end up with the integrity controls built into seem solutions,
which then are cited as appropriate controls to meet this requirement.
The testing procedure of a 10.5 point five is for the QoS A to
both look at the configuration of the change detection software
and also the logs generated by it