| Panel |
|---|
Document Name: NCSA Security Monitoring Policy Approved: 2008 by the Office of the CIO |
Scope
This policy covers all users of NCSA production systems for external customers, including Blue Waters.
...
The primary threat to the security of NCSA production systems comes from user "identity theft", often exposed as compromised user accounts and credentials. Within the existing HPC environments managed by NCSA, 25% of security incidents stem from user credentials becoming compromised and used by unathorized unauthorized persons for malicious purposes. This document details the policy covering the monitoring of user activity.
...
The detailed SSH logs, which record most command line input and output as well as file transfers, are generally rotated out of use and discarded after approximately 4 weeks unless suspicious activites activities have occurred. These logs provide much of the input for the host-based intrusion detection system. For specific security incidents, relevant portions of these logs may be saved into our incident response tracking system or other areas. Higher-level logs (e.g., network flows, IDS alerts, authentication logs, process accounting, and general system logs) may be held for longer periods of time.
Host-based Intrusion Detection System (HIDS)
Wiki Markup