Security Logging, Detection and Incident Response

If it is not logged, it did not happen

Prevention fails eventually, so you need to detect and respond. Log security-relevant events with enough context to reconstruct what happened: logins and failures, permission changes, access to sensitive records, admin actions, deploys, and denied requests, each with a timestamp, actor, source IP and request ID. Send logs to a central, tamper-resistant store, because an attacker with server access may delete local files. Equally important is what not to log: passwords, tokens, full card numbers and unnecessary personal data. Detection rules then alert on patterns, such as many failed logins followed by a success or a new cloud access key created at night. When an alert becomes an incident, follow a known sequence, commonly described as prepare, detect and analyse, contain, eradicate, recover, and learn. Write runbooks before you need them, and finish with a blameless review that produces pipeline or design changes.

Redacting secrets before they reach logs

A logging filter that masks bearer tokens and password fields in every message.

import logging, re, sys

class Redact(logging.Filter):
    PATTERNS = [(re.compile(r"(Bearer\s+)[\w.-]+"), r"\1[REDACTED]"),
                (re.compile(r"(password=)\S+"), r"\1[REDACTED]")]
    def filter(self, record):
        msg = record.getMessage()
        for pat, repl in self.PATTERNS:
            msg = pat.sub(repl, msg)
        record.msg, record.args = msg, None
        return True

log = logging.getLogger("auth")
handler = logging.StreamHandler(sys.stdout)
handler.addFilter(Redact())
log.addHandler(handler)
log.setLevel(logging.INFO)
log.info("login user=asha password=hunter2 ip=10.0.0.7")
log.info("call upstream with Authorization: Bearer eyJhbGciOi.abc.def")

Output:

login user=asha password=[REDACTED] ip=10.0.0.7
call upstream with Authorization: Bearer [REDACTED]

CCTV and a fire drill

CCTV (logging) is useless if nobody watches the alerts, and a fire is no time to discover nobody knows the exits. Detection and rehearsed runbooks work together.

Quick check: During an incident, what usually comes right after confirming and analysing the attack?

• Writing the blameless review
• Buying a new security tool
• Containment, to stop further damage
• Deleting all logs