Lottery Log Management: Reviewing Gaming System Logs Why, What, and How

Lottery Log Management:Reviewing Gaming System Logs

Why, What, and How

©2009 Delehanty Consulting LLC

Why You Should Review

• Keep you and your director from getting fired!

• Consistent with business objectives


Every Standard Says You Should!(Do you want to explain why you weren’t?)

• NIST 800-92 Guide to Computer Security Log Management

• ISO 27002/17799 Code of practice for information security management

• COBIT 4 Control Objectives for Information & Technology

• NIST 800-53 Recommended Security Controls for Federal Information Systems


Lottery’s Log Management Business Objectives

1. Security Operations: Security policies and systems are operating as planned

2. IT Operations: Determine whether IT operations can be improved and whether they are susceptible to issues

3. Forensics: Capture admissible proof that could serve as evidence if harm was done or rules/policies were intentionally broken


Analyze What?

• SANS – Top 5 Essential Log Analyses

• NIST SP 800-92 Guide to Computer Security Log Management (consistent with ISO 17799/27002)


SANS Essential Log Analyses

1. Attempts to access through existing accounts

2. Failed file or resource access attempts

3. Unauthorized changes to groups, users, etc.

4. Suspicious/unauthorized network traffic


NIST Additions

• Transaction information

• Significant Operational Actions – Application startup and shutdown– Task execution– Application failures.


Transaction Information

• All transactions should be written to a master transaction file that cannot be altered prior to being received by the Lottery

• Requirement met by:– Transaction Master File– ICS system

• Better source for forensic evidence than Gware


HowActivity Analysis Strategies

1. Review all activities and processes

2. Focus on high-risk activities

3. Focus on high-risk processes

4. Develop baselines and then look for anomalies

5. Time sampling or all days

6. All systems, select systems, or sampling

How – A Process ApproachYou’re First Log Review

• High risk

• Daily review

• All gaming systems

• Handout leads you through process


Documents

Lottery Log Management: Reviewing Gaming System Logs Why, What, and How