During a county IR exercise, several critical servers have little or no retained authentication history. What should leadership prioritize before the next real incident?
Select an answer to reveal the explanation.
Short Explanation
Missing logs are like security cameras with no tape—by the time you need the footage, there is nothing to rewind. Centralized logging with real retention fixes that before the next county incident. Keeping scraps on each box for three days, or skipping logs entirely, guarantees another blind investigation.
Full Explanation
Inadequate or missing logs are an investigative gap that must be remediated through centralized collection and sufficient retention. Local short-lived logs are easily lost during compromise or failure, and verbal meetings cannot reconstruct access timelines. Prioritizing enterprise logging improves detection and post-incident analysis for subsequent events.