[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fau-9":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","au-9","AU-9","Protection of Audit Information",26,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Audit information and logging tools must be protected from unauthorised access, modification and deletion, and personnel must be alerted when this happens.\n\n**In practice.** This means forwarding logs promptly to a central platform with restricted administrative access, using immutable or write-once storage for critical logs, separating log administration from system administration and alerting on logging being stopped or cleared. Auditors look for access lists for the logging platform, retention and immutability settings and alerts on log tampering. Backups of log data should be protected in the same way as the live store.\n\n**Common gaps.** Logs held only on the systems that generate them can be wiped by an attacker. Administrators of production systems often also have full rights over the logging platform. Retention may also be set too short to support investigations that start weeks after the intrusion.","a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and\n  b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.\nDiscussion: Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":25,"title":26,"published_at":27},"marklogic-flaws-let-limited-users-seize-persistent-admin-control","MarkLogic Flaws Let Limited Users Seize Persistent Admin Control","2026-10-13T10:20:46.693+00:00",{"slug":29,"title":30,"published_at":31},"atm-jackpotting-malware-driven-cash-theft-highlights-physical-and-cyber-atm-security-gaps","ATM Jackpotting: Malware-Driven Cash Theft Highlights Physical and Cyber ATM Security Gaps","2026-10-02T16:20:41.59+00:00",{"slug":33,"title":34,"published_at":35},"gdpr-article-31-self-incrimination-rights-vs-regulatory-cooperation-obligations","GDPR Article 31: Self-Incrimination Rights vs. Regulatory Cooperation Obligations","2026-09-30T16:20:39.146+00:00",{"slug":37,"title":38,"published_at":39},"settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","2026-09-17T18:21:03.162+00:00",{"slug":41,"title":42,"published_at":43},"spains-aepd-rules-ministry-of-defence-violated-gdpr-by-withholding-health-data-access-logs","Spain's AEPD Rules Ministry of Defence Violated GDPR by Withholding Health Data Access Logs","2026-09-15T18:21:41.527+00:00",{"slug":45,"title":46,"published_at":47},"spains-aepd-blanket-refusal-to-disclose-health-data-access-logs-violates-gdpr-article-15","Spain's AEPD: Blanket Refusal to Disclose Health Data Access Logs Violates GDPR Article 15","2026-09-15T16:22:14.189+00:00",{"slug":49,"title":50,"published_at":51},"spains-aepd-finds-ministry-of-defence-violated-gdpr-patient-data-access-rights","Spain's AEPD Finds Ministry of Defence Violated GDPR Patient Data Access Rights","2026-09-10T16:21:15.194+00:00",{"slug":53,"title":54,"published_at":55},"gdpr-violation-controller-deletes-data-during-active-access-request","GDPR Violation: Controller Deletes Data During Active Access Request","2026-09-09T10:20:41.088+00:00",{"slug":57,"title":58,"published_at":59},"fire-ant-turns-cisco-routers-into-covert-spy-nodes","Fire Ant Turns Cisco Routers Into Covert Spy Nodes","2026-08-31T16:20:25.339+00:00",{"slug":61,"title":62,"published_at":63},"fire-ant-hijacks-cisco-routers-to-harvest-credentials-and-suppress-logs","Fire Ant Hijacks Cisco Routers to Harvest Credentials and Suppress Logs","2026-08-31T12:21:59.237+00:00",{"slug":65,"title":66,"published_at":67},"poisoned-logs-hijack-ai-agents-in-ghostjacking-attack","Poisoned Logs Hijack AI Agents in 'Ghostjacking' Attack","2026-08-10T14:20:19.522+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",10,{"slug":75,"name":76,"problem":77,"stories":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",8,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":85,"name":86,"problem":87,"stories":88},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":90,"name":91,"problem":92,"stories":88},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":94,"name":95,"problem":96,"stories":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[98,103,108,112,116,120,125,129],{"family":99,"item":100,"code":101,"title":101,"together":102},"itil","overview","ITIL",17,{"family":104,"item":105,"code":106,"title":107,"together":102},"cis","8","Control 8","Audit Log Management",{"family":104,"item":109,"code":110,"title":111,"together":73},"3","Control 3","Data Protection",{"family":5,"item":113,"code":114,"title":115,"together":73},"ac-2","AC-2","Account Management",{"family":5,"item":117,"code":118,"title":119,"together":73},"ac-6","AC-6","Least Privilege",{"family":104,"item":121,"code":122,"title":123,"together":124},"12","Control 12","Network Infrastructure Management",9,{"family":104,"item":126,"code":127,"title":128,"together":78},"7","Control 7","Continuous Vulnerability Management",{"family":130,"item":131,"code":132,"title":133,"together":83},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data"]