During a county IR exercise, several critical servers have little or no retained authentication history. What should leadership prioritize before the next real incident?
Select an answer to reveal the explanation.
Short Explanation
Missing logs are like security cameras with no tape—by the time you need the footage, there is nothing to rewind. Centralized logging with real retention fixes that before the next county incident. Keeping scraps on each box for three days, or skipping logs entirely, guarantees another blind investigation.
Full Explanation
Investigations fail when authentication and security events were never retained. During a county IR exercise, discovering that critical servers lack usable authentication history exposes a preparedness gap: responders cannot establish who logged in, from where, or whether privilege use was anomalous. Leadership should prioritize centralized logging with adequate retention—shipping auth, system, and security logs to a SIEM or log platform with retention aligned to investigative and compliance needs—so data exists before the next real incident. Centralization also protects logs from local wipe by attackers and enables correlation across hosts.
Disabling authentication to reduce log volume removes a core control and still fails to create investigative telemetry. Storing logs only on each local host with three-day retention leaves evidence fragile, short-lived, and easy for ransomware or admins to destroy. Replacing logging with monthly verbal status meetings provides no forensic timeline. Exam caveat: stems about missing history during IR point to centralized collection and retention, not less logging. Operationally, inventory critical county servers for log forwarding, set retention floors (for example, weeks to months per policy), alert on logging failures, and re-run the IR exercise to confirm analysts can retrieve authentication timelines for those hosts within minutes.