Collect Audit Logs There's a predictable early move in a lot of intrusions: once an attacker is on a machine, they clear its local logs. If the only record of what happened lives on the same computer that was compromised, you've effectively handed the person you're investigating the ability to edit the evidence. Control 8.2 solves that by getting your logs off the individual machines and into a place an attacker can't quietly reach. If 8.1 was the decision about what to record, 8.2 is the act...
No Results Found
The page you requested could not be found. Try refining your search, or use the navigation above to locate the post.
