Logboek met inhoud in plaats van gebeurtenissen
Een logboek bewaart wat iemand invulde of te zien kreeg, terwijl vastleggen dat er iets gebeurde volstaat.
- Familie
- Gegevens
- Status
- actief
- Geldt voor
- backend
Wat er gebeurt
Logging is set to a level that writes the payload: the body of a request, the fields of a form, the text of a message, the parameters of a query, the response returned to the person. The line then holds the content itself instead of a reference to the record it belongs to. Because logs exist for running the system rather than for the process they describe, they usually sit outside the retention schedule of that process, are readable by more people, are copied into a search or monitoring system, and are kept for as long as storage allows.
Waarom het ertoe doet
Content is where the sensitive part is. A log written this way holds what someone searched for, what they wrote to a helpdesk, the contents of a report about their health or their debts, in a store that was never designed to hold it, that an access request usually never reaches, and that outlives the deletion of the record it came from.
Veelvoorkomende oorzaken
- debug logging left on after release
- a framework that writes full request and response bodies by default
- an error handler that serialises the whole object it failed on
- the payload written deliberately, to make support easier
Dit is het níet
Content reaching another party is User input to third parties; this entry is about the operator's own store, and content does not have to leave the organisation to be in the wrong place. A log recording that a record was opened, by whom and when, is the normal case and is not this entry.
Hoe je het vaststelt
Indicator
A value only the person could have supplied, a distinctive marker string entered into a field for this test, appears in the log records the operator returns for that session, whether through an access request, a support export or the log store itself. The line contains the value rather than a reference to where the value is kept.
Methode
document-comparison
Kwaliteit van de detectie
85 van 100
De grenzen van deze bevinding
Wat dit patroon zou weerleggen
- The marker appears only in the record that is part of the process itself, not in a log.met de hand te toetsende bevinding vervalt
- The log line holds the value in a masked form, or a reference instead of the value.machinaal te toetsende bevinding vervalt
- The log store falls under the same retention and access rules as the process record, and an access request reaches it.met de hand te toetsende bevinding wordt zwakker
- The logging level was raised for a bounded incident and the records were destroyed when it closed.met de hand te toetsende bevinding wordt zwakkerCheckable against the change record and the retention of the store, rather than against the recollection of the engineer.
Wat dit patroon níet vaststelt
- harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
- severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
- unlawfulness; that is for a supervisory authority or a court
- intent; a fault is usually a build decision, not a plan
- absence: not finding it in one capture is not evidence that it is not there
Reproduceren
- manual
METHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above
Juridisch kader
Bepalingen
Veelgehoorde tegenwerpingen
Logs are technical data.
The store is technical; the content is not. What determines the category is what the line contains, not which directory it sits in.
Nobody reads them.
Access is what counts, not habit. And a log nobody reads is a log whose retention nobody watches.
We need it to debug.
Then it is needed for the length of the investigation, as a reference plus the record it points to, rather than as a copy of the content kept for a year.
They are deleted after ninety days.
Show where that is written for this store, and check it against the monitoring system the lines were copied into. Retention set for one store rarely follows the copy.
Geldt wanneer
to-processing