FFIEC/CFPB Compliance

Control-1: Determine whether access to system administrator level is adequately controlled and monitored.

Logcollect  collects all account management usage activity. The creation of privileged accounts (i.e., administrator, root) or granting of privileged rights is easily and automatically monitored, alerted and reported on.

Logcollect  can collect logs from network devices, IDS/IPS systems, Anti-Virus, firewalls and other security devices. Logcollect  provides central analysis and monitoring of intrusion related activity across the IT Infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks.

Logcollect’s Personal Dashboard provides customized real-time monitoring of events and alerts. Logcollect’s Investigator provides deep forensic analysis of intrusion related activity. Logcollect’s integrated knowledge base provides information and references useful in responding to and resolving intrusions.

Control-2: Determine whether logs of security related events are appropriately secured against unauthorized access, change and deletion for an adequate time period, and that reporting to those logs is adequately protected.

Logcollect  helps ensure audit trail are protected from unauthorized modification. Logcollect  collects logs immediately after they are generated and stores them in a secure repository. Logcollect  servers utilize access controls at the operating system and application level to ensure that log data cannot be modified or deleted.

Logcollect  completely automates the process of retaining the audit trail. Logcollect  creates archive files of all collected log entries. These files are organized in a directory structure by day making it easy to store, backup and destroy log archives based on the policy.

Control-3: Determine whether remote access devices and network access points for remote equipment are appropriately controlled.

• Remote access is disabled by default, and enabled only by management authorization.
• Management authorization is required for each user who accesses sensitive components or data remotely.
• Authentication is of appropriate strength (e.g., two-factor for sensitive components).
• Modems are authorized, configured and managed to appropriately mitigate risks.
• Appropriate logging and monitoring takes place.
• Remote access devices are appropriately secured and controlled by the institution.

Logcollect  collects network device logs. Logcollect  analysis & reporting capabilities can be used for reviewing network activity to ensure only authorized communications occur. Logcollect  alerts can be used for detecting unauthorized communications. Logcollect  collects remote access activity for VPN, SSH, etc. EventTracker reports provide easy and independent review of remote access to information systems.

Logcollect  can collect logs from IDS/IPS systems. Logcollect  provides robust alerting and notification capabilities that help ensure alerts are routed to the appropriate individuals. Logcollect  integrated incident management capabilities provide accountability and reporting on alarm resolution.

Control-3: Determine whether logs are sufficient to affix accountability for host activities and to support intrusion forensics and IDS and are appropriately secured for a sufficient time period.

Logcollect  helps ensure audit trail are protected from unauthorized modification. Logcollect  collects logs immediately after they are generated and stores them in a secure repository. Logcollect  servers utilize access controls at the operating system and application level to ensure that log data cannot be modified or deleted.

Control-1: Determine whether appropriate logs are maintained and available to support incident detection and response efforts.

Logcollect  completely automates the process of retaining your audit trail. Logcollect  creates archive files of all collected log entries. These files are organized in a directory structure by day making it easy to store, backup and destroy log archives based on your policy. Logcollect  detects the incident automatically and alerted on.

Control-1: Evaluate whether the software acquired incorporates appropriate security controls, audit trails, and activity logs and that appropriate and timely audit trail and log reviews and alerts can take place.

Logcollect  collects logs from commercial and custom applications. Logcollect  provides central analysis, reporting, and alerting for application logs.

• Review the schematic of the information technology systems for common security monitoring devices.
• Review security procedures for report monitoring to identify unauthorized or unusual activities.
• Review management’s self-assessment and independent testing activities and plans.

Logcollect  can collect logs from IDS/IPS systems, A/V systems, firewalls, and other security devices. Logcollect  provides central analysis and monitoring of intrusion related activity across the IT infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks. Logcollect’s Personal Dashboard provides customized real-time monitoring of events and alerts. Logcollect’s Investigator provides deep forensic analysis of intrusion related activity. Logcollect’s integrated knowledge base provides information and references useful in responding to and resolving intrusions. Logcollect  ensures audit trails are protected, retained, and can be easily restored years later.

Control-2: Determine whether logs of security related events are sufficient to support security incident detection and response activities, and that logs of application, host and network activity can be readily correlated.

Logcollect  can collect logs from IDS/IPS systems, A/V systems, firewalls, and other security devices. Logcollect  provides central analysis and monitoring of intrusion related activity across the IT infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks. Logcollect’s Personal Dashboard provides customized real-time monitoring of events and alerts. Logcollect’s Investigator provides deep forensic analysis of intrusion related activity. Logcollect’s integrated knowledge base provides information and references useful in responding to and resolving intrusions. Logcollect  ensures audit trails are protected, retained, and can be easily restored years later.

Control-3: Determine whether logs of security related events are appropriately secured against unauthorized access, change and deletion for an adequate time period, and that reporting to those logs is adequately protected.

Logcollect  can collect logs from IDS/IPS systems, A/V systems, firewalls, and other security devices. Logcollect  provides central analysis and monitoring of intrusion related activity across the IT infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks. Logcollect’s Personal Dashboard provides customized real-time monitoring of events and alerts. Logcollect’s Investigator provides deep forensic analysis of intrusion related activity. Logcollect’s integrated knowledge base provides information and references useful in responding to and resolving intrusions. Logcollect  ensures audit trails are protected, retained, and can be easily restored years later.

Control-4: Determine whether logs are appropriately centralized and normalized, and that controls are in place and functioning to prevent time gaps in logging.

Logcollect  can collect logs from IDS/IPS systems, A/V systems, firewalls, and other security devices. Logcollect  provides central analysis and monitoring of intrusion related activity across the IT infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks. Logcollect’s Personal Dashboard provides customized real-time monitoring of events and alerts. Logcollect’s Investigator provides deep forensic analysis of intrusion related activity. Logcollect’s integrated knowledge base provides information and references useful in responding to and resolving intrusions. Logcollect  ensures audit trails are protected, retained, and can be easily restored years later.

Control-5: Determine whether an appropriate process exists to authorize employee access to security monitoring and event management systems and that authentication and authorization controls appropriately limit access to and control the access of authorized individuals.

Logcollect  provides centralized secure access to all log data. Logcollect  leverages application and database level controls to restrict user access to authorized data and functions. Logcollect  includes discretionary access controls for restricting users to a defined subset of the log data collected.

Control-6: Determine whether appropriate detection capabilities exist related to:

• Network related anomalies, including Blocked outbound traffic
• Unusual communications, including communicating hosts, times of day, protocols and other header related anomalies
• Unusual or malicious packet payloads
• Host-related anomalies, including
• System resource usage and anomalies
• User related anomalies
• Operating and tool configuration anomalies
• File and data integrity problems
• Anti-virus, anti-spyware, and other malware identification alerts
• Unauthorized access
• Privileged access

Logcollect  can collect logs from hosts, network devices, IDS/IPS systems, Anti-Virus, firewalls and other security devices. Logcollect  provides central analysis and monitoring of network and host activity across the IT infrastructure. Logcollect  can correlate activity across user, origin host, impacted host, application and more. Logcollect  can be configured to identify known bad hosts and networks. Logcollect  alarming capability can be used to independently detect and alert on network and host based anomalies via sophisticated filtering, correlation and threshold violations.