Secure Coding: Principles and Practices Creating a National Alerting and Reporting Service

E. Larry Lidz, University of Chicago Looking at problems from the network: Often, we don’t have access to the machine we suspect of being involved in a compromise (the machine is physically inaccessible, it belongs to a student, etc.). Network audit logs can save the day: If we are able to go back and show where a problem came from, we can quickly resolve the problem. Also, if it is necessary to turn over evidence to authorities, it can be legally easy to turn over network audit logs, which tend not to contain confidential information, whereas it can be really tricky to turn over the hard drives of compromised machines (because confidential information must be protected).