BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.6.5 Event Logging

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 3 Principles and Key Concepts part of 3.6

Title

Event Logging

Control

Logging firmware and recovery-related events can often be useful for multiple purposes, including but not limited to:

• Forensic analysis which allows for a Platform Administrator of a system to capture information which might have led to an attack on a platform or actual platform compromise. This can be useful in determining if the platform might contain an unknown security vulnerability, or understanding if there might be a widespread attack of a similar nature.
• Providing an audit trail to know when an event has occurred and if an update or recovery was authorized, who authorized it and when.

Platform and device manufacturers need to determine what level of event logging might be required for their systems, taking into account the intended users’ environments for those systems. Events which are logged should be recorded in a manner which provides assurances of their integrity and allows for the secure recovery and transmission of logged events. Care must be taken to ensure event log access is controlled. Unauthorized personnel can use event log data analysis to broaden the attack surface.