From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Unlock this course with a free trial

Join today to access over 24,000 courses taught by industry experts.

Firewall and network logs

Firewall and network logs

From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Start my 1-month free trial Buy for my team

Firewall and network logs

“

- [Instructor] Firewalls and network devices are on the front lines of security and their logs contain important information for security professionals. These logs are useful when investigating security incidents, troubleshooting network issues, and monitoring networks for suspicious activity. Firewall logs are one of the richest possible sources of information. When configured properly, firewalls create log entries for each and every connection attempted on a network, whether it was allowed or denied. The log entries contain quite a bit of useful information, including details about the attempted connection, including source and destination IP addresses and ports. They include a timestamp indicating when the connection took place and the identity of the firewall rule that either authorized or denied the connection. Let's think about some scenarios where these logs might be very useful. First, in the aftermath of a security incident, these logs may show all of the connections…

Contents