Entrust nShield User Manual

platforms. Each log fulfills a different purpose and some can be filtered to control the
amount of information logged. See the User Guide for details. In some instances tamper
or cryptographic mechanisms are used to protect the integrity of the logs. Logs that
don’t use these mechanisms should be protected through procedural controls.
A threat analysis will determine which logs are required and which filters to apply (if
available) in monitoring the customer’s specific deployment of the HSM.
The Auditor should be independent of the Administrator of the HSM:
•
When modifications are made to the configuration of an HSM, the changes should be
audited to ensure that the configuration has been modified in the intended way.
•
The Auditor should regularly inspect the logs to verify that the unit’s configuration
reflects the Security Policy.
•
The logs should be inspected by the Auditor periodically at a frequency determined
by the customer Security Procedures.
•
The customer Security Procedures should state what log entries are cause for
concern.
The following example scenarios may also be a cause for concern:
•
Access outside of work hours
•
Unusual changes to the configuration
•
Unit power cycled.
The actions required to resolve the issue should also be stated using the customer’s own
incident response process.
The customer Security Procedures should identify a backup policy for the logs and the
authorization required to delete logs once they’ve been backed-up.
9.4. Audit logging
Audit logging as described in Logging and debugging delivers logs to an external log
collector outside of the HSM. It uses an integrity mechanism to protect the logs.
Additional controls required to support the Audit Log are described in Audit Log. As well
as applying the guidance described above, further guidance specific to Audit Logging is
supplied here:
The Auditor should inspect the logs to:
•
Identify missing logs
•
Verify the integrity of logs up to the trusted root
•
Identify log entries that are a cause for concern.
nShield® Security Manual 65 of 90

Entrust nShield Specifications

General

Brand	Entrust
Model	nShield
Category	Security System
Language	English