“I was asleep at the time”
A sign-in in the small hours, and the logs are scattered and already expired.
(Illustrative scenario, not a real incident)
Xiao Zhe is an engineer at a fintech startup.One morning he found a sign-in on his accountin the early hours.He was sure he’d been asleep then.
The sixty-person company began to investigate.
The single sign-on logs were kept for only thirty days.The email system depended on the plan.The password manager’s logs had to be exported separately.Access logs for the cloud serviceshad never been turned on.
It took several daysto piece together an incomplete timeline.The earliest suspicious sign-inwas weeks before the day it was discovered.Some of the logs had already expired and been deleted.
Every log had a different format,a different time zone, a different retention period.
What you see is one sign-in in the small hours.What you don’t seeare the weeks of quiet before it.
I used to think keeping logs was enough.Later I realizedthe value of logs isn’t in having them,but in being able to find them, line them up,and having someone actually watching.
Only when the mind is stillcan you hear the sound of something wrong.
- List how many days each system keeps its logs.
- Turn on audit logging for important systems first.
- Bring them into one place, in one time zone.
- Set up a few alerts, so anomalies make a sound.