When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.
When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds.
Time of Introduction
Technical Impact: Hide activities
If security critical information is not recorded, there will be no
trail for forensic analysis and discovering the cause of problems or the
source of attacks may become more difficult or impossible.
Likelihood of Exploit
The example below shows a configuration for the service security
audit feature in the Windows Communication Foundation (WCF).
The previous configuration file has effectively disabled the recording
of security-critical events, which would force the administrator to look
to other sources during debug or recovery efforts.
Logging failed authentication attempts can warn administrators of potential brute force attacks. Similarly, logging successful authentication events can provide a useful audit trail when a legitimate account is compromised. The following configuration shows appropriate settings, assuming that the site does not have excessive traffic, which could fill the logs if there are a large number of success or failure events (CWE-779).
web server does not log requests for a
non-standard request type
Phase: Architecture and Design
Use a centralized logging mechanism that supports multiple levels of
detail. Ensure that all security-related successes and failures can be
Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks. At the same time, logging too much data (CWE-779) can cause the same problems.