Logging is an example of which type of defense against systems compromise?
A.
Containment
B.
Detection
C.
Reaction
D.
Recovery
Explanation:
Detection defenses include logging as well as monitoring, measuring, auditing, detecting viruses
and intrusion. Examples of containment defenses are awareness, training and physical security
defenses. Examples of reaction defenses are incident response, policy and procedure change,
and control enhancement. Examples of recovery defenses are backups and restorations, failover
and remote sites, and business continuity plans and disaster recovery plans.
Detection is incorrect. Logging itself provides no defense. A review based on logging is a detective control after the event has happened and can help provide information towards defending systems. If every activity was logged AND classified within the log, but nothing was done with the log, then it provides no value.