Operating System Auditing

Implement the following operating system auditing recommendations:

• Use platform-level auditing to audit login and logout events, access to the file system, and failed object access attempts.

• Back up log files and regularly analyze them for signs of suspicious activity.

• Secure log files by using restricted access control lists, and relocate system log files away from their default locations to make sure attackers cannot cover their tracks.

For additional information on operating system auditing, see your operating system documentation.