• an attempt to access a file or resource is denied due to insufficient privilege.
• the permissions of a user or group are changed.
• a new processes is created and the system activity related to the process.
• a user changes their level of privilege.
• when the host-based firewall denies a network connection.
• all significant application events.

For each audit event logged the system includes sufficient information to investigate the event, including related IP address, timestamp, hostname, username, application name and/or other details as appropriate. System logs are written to a different remote system in such a way that they cannot be altered by any user on the system being logged.

Network Security
The various departments have both intranets and extranets that are used to share information with …show more content…
Both the source and destination of the transmission must be verified.
h) Storage encryption: Restricted data must be encrypted using strong, public cryptographic algorithms and reasonable key lengths given current computer processing capabilities. Keys must be stored securely, and access to them provided on a least-privilege basis
i. Encrypt files containing restricted data using different keys or passwords than those used for system logon. ii. Encrypt data stored in databases at the column-level. iii. In addition to file and/or database encryption, implement full-disk encryption on portable devices containing restricted data.
i) Retention: Restricted data should only be stored for as long as is necessary to accomplish the documented business process.
j) Destruction: When restricted data is no longer needed it should be destroyed using methods that are resistant to data-recovery attempts such as cryptographic data destruction utilities or on-site physical device destruction.
k) Incident Notification: If there is a potential security incident which may place restricted data at risk of unauthorized access, ITS Technology Security Services must be