ASD ISM 1960 Timely analysis of event logs for cyber security
What it says
Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInternet-facing device logs are quickly reviewed to find security issues.
Event logs from devices that connect to the internet are reviewed quickly to catch any security issues. This is important because if someone tries to hack your network or steal your information, the logs might show unusual activity. If these aren't checked regularly, you might miss early warnings and suffer data loss or a cyber incident that could have been prevented.
Free. Save your status, tasks and notes.
Why it matters
Delayed analysis of internet-facing device logs can lead to undetected intrusions, resulting in data breaches and compromised network integrity.
How to implement
The IT team should establish a routine for checking event logs from internet-facing devices.
They can do this by setting up a daily schedule to review these logs and flagging anything out of the ordinary. This can be done using software that highlights suspicious patterns or manual checks if resources are limited.
Managers should allocate responsibility for log reviews to a specific team member or group.
They need to ensure that this person or group is trained to know what to look for, such as unauthorised access attempts, and has the time and resources to do it consistently.
System owners should work with IT staff to ensure all internet-facing devices have logging enabled.
They should confirm that logs are being stored securely and are accessible for review without being tampered with. This might involve configuring settings on routers, firewalls, and servers.
IT teams should ensure that the logs cover an adequate period to detect patterns over time.
A general rule is to retain logs for at least 90 days. This allows for a window to spot trends or repeated issues that might be missed with shorter logs.
Regularly update the team's methodology on what to review in the logs based on the latest security threat information.
IT and security staff should stay informed through trusted sources, such as the Australian Cyber Security Centre, to keep their approach current.
Keep it running
Review internet-facing device event logs daily and alert on suspicious activity (e.g., repeated failed logins, config changes), escalating incidents for investigation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest event log review schedule: Request to see the calendar or documentation that details when and how often logs are reviewed. Look to ensure a clear schedule is in place with assigned personnel.
Good evidence
Will show logs are reviewed daily or weekly by named individuals.
- Check 2 of 5What an auditor asks for
Ask for
A sample of recent reviewed logs: Obtain logs marked with identified incidents or anomalies.
Look at
Notes or comments indicating what was found and actions taken. Good evidence will show prompt attention to issues with clear responses logged.
- Check 3 of 5What an auditor asks for
Ask for
Documentation on log retention policies: Request the policy document that outlines how long logs are kept. Look to ensure it states the retention period and secure storage practices.
Good evidence
Will match industry standards, such as the recommended 90 days or more.
- Check 4 of 5What an auditor asks for
Ask for
To see the training records for team members responsible for log review: Verify completion of training specific to identifying log integrity and anomalies.
Look at
Valid, dated certificates or records of completed courses.
Good evidence
Will show recent training completion, ideally from credible sources like the Australian Signals Directorate.
- Check 5 of 5What an auditor asks for
Ask for
A report on recent security incidents identified through log analysis: Request to see a brief report detailing incidents flagged from logs.
Look at
The response timelines and actions taken.
Good evidence
Outcome indicates rapid identification and mitigation efforts based on the logs.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.8, Cyber security events are analysed in a timely manner, which this control covers in full and more.
ASD Essential Eight: 9 mappings
This control is broader than E8-AC-ML2.8.
E8-AC-ML2.8 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-1960 focuses on timely analysis of event logs from internet-facing network devices to detect cyber security events. The candidate is a specific implementation domain within the broader event analysis required by E8-AC-ML2.8.
This control is broader than E8-MF-ML2.9.
E8-MF-ML2.9 requires timely analysis of cybersecurity events to identify incidents. ISM-1960 is a narrower requirement focused on analysing logs from internet-facing network devices to detect cyber security events, which contributes to the broader analysis required by E8-MF-ML2.9. The primary control applies across event sources and includes determining when detected events are incidents.
- E8-AC-ML2.7Event logs from internet-facing servers are analysed to detect cyber security eventsPartially overlaps
This control partially overlaps E8-AC-ML2.7.
ISM-1960 requires event logs from internet-facing network devices to be analysed in a timely manner to detect cyber security events. E8-AC-ML2.7 is closely related but focuses specifically on internet-facing servers. ISM-1960 has a broader device scope, covering additional network devices like firewalls and proxies.
This control partially overlaps E8-AC-ML3.4.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers for cyber security event detection. ISM-1960 involves similar monitoring activities for internet-facing network devices. They overlap in detection through log analysis but differ in both exposure and technology type.
This control partially overlaps E8-AH-ML2.14.
E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1960 requires timely analysis of event logs from internet-facing network devices, applying the same monitoring/analysis practice but to a different technology class. They overlap on the log analysis activity and timeliness expectation, but cover different sources (servers vs network devices).
This control partially overlaps E8-AH-ML3.5.
E8-AH-ML3.5 addresses timely analysis of workstation event logs to detect cyber security events. ISM-1960 applies the same type of requirement to internet-facing network devices' event logs. The overlap is in the monitoring practice and timeliness for detection, but the covered assets and log content differ materially (endpoint events versus perimeter/network device events).
This control partially overlaps E8-RA-ML2.9.
ISM-1960 and E8-RA-ML2.9 both require prompt log review for detection. ISM-1960 has broader coverage of internet-facing devices, not just servers.
This control partially overlaps E8-RA-ML3.9.
E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-1960 requires timely analysis of event logs from internet-facing network devices for the same purpose. They overlap on the operational monitoring requirement, but differ materially in log source and threat exposure context (end-user workstations vs internet-facing devices).
This control supports E8-RA-ML2.10.
ISM-1960 supports E8-RA-ML2.10 by ensuring timely review of perimeter events. This aids in the timely analysis of detected events to identify incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.