NSA Issues Tips for Better Logging, Threat Detection in LotL Incidents
The guidance is part of a coordinated, global effort to eradicate living-off-the-land techniques used against critical infrastructure.
![Internal hardware with the NSA logo printed on it Internal hardware with the NSA logo printed on it](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc500c05eef79a687/66c78f4294683e8e56e3b01c/nsa_Carsten_Reisinger_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The National Security Agency (NSA) released a publication detailing best practices for event logging and threat detection against threat actors using living-off-the-land (LotL) techniques.
The document details best practices to improve security in cloud services, enterprise networks, mobile devices, and operational technology (OT) networks, and to ensure critical infrastructure remains robust, the agencies said. The document was jointly released by the NSA along with its counterparts in Australia, Canada, Japan, New Zealand, Singapore, and South Korea.
"It is essential for organizations to strengthen their resilience against living off the land techniques that are pervading today's cyber threat environment," said David Luber, NSA cybersecurity director. By implementing an effective logging solution, the security and resilience of systems as well as incident response programs will be improved, he added.
The guidelines are directed toward senior IT "decision makers," operational technology operators, and network administrator and operators, and focus on enterprise-approved logging policy; centralized log access and correlation; secure storage and log integrity; and detection strategy for relevant threats.
About the Author
You May Also Like
State of AI in Cybersecurity: Beyond the Hype
October 30, 2024[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024