WebOTG-LA-001 — Security Event Logging & Incident Detection Standard

1. Executive Summary & Scope

Insufficient Logging and Alerting allows active attacks to go undetected for weeks or months. Without adequate logging of authentication attempts, privilege changes, and critical business actions, security teams cannot detect intrusions or perform incident post-mortems.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-778 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

Adversaries compromise an employee account and execute lateral movement across internal systems undetected because failed access attempts and permission changes are not recorded.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: Silent authorization failures with no audit trail if (!hasPermission($user, 'export_customer_data')) { // Silently fails, zero security logs generated! return false; }

Hardened Defense-in-Depth Implementation

// REMEDIATED: Structured JSON audit log with security context function logSecurityEvent(string $eventType, string $outcome, array $context): void { $record = [ 'timestamp' => gmdate('Y-m-d\TH:i:s.v\Z'), 'event_type' => $eventType, 'outcome' => $outcome, 'user_id' => $_SESSION['user_id'] ?? null, 'ip_address' => get_client_ip(), 'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? '', 'trace_id' => $_SERVER['HTTP_X_REQUEST_ID'] ?? bin2hex(random_bytes(8)), 'context' => $context ]; // Write to dedicated immutable log stream error_log(json_encode($record), 3, "/var/log/app/security-audit.log"); }

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Failed Login Audit	Trigger 3 failed login attempts and inspect audit log stream.	All 3 attempts recorded with IP, username, timestamp, and failure reason.
Privilege Change Audit	Promote user to administrator role in admin console.	Log records exact operator ID, target user ID, and timestamp.
Log File Permissions	Verify `/var/log/app` is owned by logging daemon and append-only.	Web application worker cannot overwrite or truncate historical log entries.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.