Security logging and monitoring jippermettu l-detezzjoni u r-risposta għal theddid u inċidenti ta' sigurtà. Mingħajr logging/monitoring adegwat, l-attakki ma jiġux nnotizzati — li hija għaliex "insufficient logging and monitoring" hija rikonoxxa bħala riskju ta' sigurtà (OWASP).
Għaliex logging u monitoring huma importanti għas-sigurtà
You can't respond to (or even know about) attacks you can't DETECT:
→ without logging/monitoring, breaches go UNNOTICED (often for months) → far more damage
→ "Security Logging and Monitoring Failures" is an OWASP Top 10 risk
→ detection is essential — you can't stop every attack, but you must DETECT and respond.
X'għandek tloggja u nmonitorja
✓ AUTHENTICATION events → logins, failures, lockouts (detect brute force/credential stuffing)
✓ ACCESS to sensitive data/actions → audit trail (who did what, when)
✓ AUTHORIZATION failures → repeated denied access (probing/attacks)
✓ Anomalies → unusual patterns, spikes, suspicious behavior, errors
✓ ADMINISTRATIVE/privileged actions; config changes; security-relevant events
⚠️ but DON'T log sensitive data (passwords, full card numbers, secrets) — that's a risk itself
