安全日志记录和监控能够检测和应对安全威胁与事件。如果缺乏充分的日志记录/监控,攻击就会被忽视——这也是为什么"日志记录和监控不足"被认可为安全风险 (OWASP)。
日志记录和监控对安全的重要性
You can't respond to (or even know about) attacks you can't DETECT:
→ without logging/monitoring, breaches go UNNOTICED (often for months) → far more damage
→ "Security Logging and Monitoring Failures" is an OWASP Top 10 risk
→ detection is essential — you can't stop every attack, but you must DETECT and respond.
应该记录和监控什么
✓ AUTHENTICATION events → logins, failures, lockouts (detect brute force/credential stuffing)
✓ ACCESS to sensitive data/actions → audit trail (who did what, when)
✓ AUTHORIZATION failures → repeated denied access (probing/attacks)
✓ Anomalies → unusual patterns, spikes, suspicious behavior, errors
✓ ADMINISTRATIVE/privileged actions; config changes; security-relevant events
⚠️ but DON'T log sensitive data (passwords, full card numbers, secrets) — that's a risk itself
