General Logging
V16.2.1
Verify that each log entry includes necessary metadata (such as when, where, who, what) that would allow for a detailed investigation of the timeline when an event happens.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 151, 21, 268, 49, 50, 600
V16.2.2
Verify that time sources for all logging components are synchronized, and that timestamps in security event metadata use UTC or include an explicit time zone offset. UTC is recommended to ensure consistency across distributed systems and to prevent confusion during daylight saving time transitions.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 151, 21, 268, 49, 50, 600
V16.2.3
Verify that the application only stores or broadcasts logs to the files and services that are documented in the log inventory.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 151, 21, 268, 49, 50, 600
V16.2.4
Verify that logs can be read and correlated by the log processor that is in use, preferably by using a common logging format.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 151, 21, 268, 49, 50, 600
V16.2.5
Verify that when logging sensitive data, the application enforces logging based on the data's protection level. For example, it may not be allowed to log certain data, such as credentials or payment details. Other data, such as session tokens, may only be logged by being hashed or masked, either in full or partially.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 151, 155, 169, 21, 215, 268, 31, 37, 49, 50, 54, 593, 600
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
