[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fau-9":3},{"item":4,"lessons":18,"controls":69,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","au-9","AU-9","Protection of Audit Information",26,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Audit information and logging tools must be protected from unauthorised access, modification and deletion, and personnel must be alerted when this happens.\n\n**In practice.** This means forwarding logs promptly to a central platform with restricted administrative access, using immutable or write-once storage for critical logs, separating log administration from system administration and alerting on logging being stopped or cleared. Auditors look for access lists for the logging platform, retention and immutability settings and alerts on log tampering. Backups of log data should be protected in the same way as the live store.\n\n**Common gaps.** Logs held only on the systems that generate them can be wiped by an attacker. Administrators of production systems often also have full rights over the logging platform. Retention may also be set too short to support investigations that start weeks after the intrusion.","a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and\n  b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.\nDiscussion: Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},30,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"ai-powered-espionage-tool-automates-credential-theft-and-trace-erasure-against-government-networks","AI-Powered Espionage Tool Automates Credential Theft and Trace Erasure Against Government Networks","2026-11-12T15:22:54.034+00:00",{"slug":26,"title":27,"published_at":28},"github-actions-secret-stealer-exploits-stolen-tokens-and-covers-its-tracks","GitHub Actions Secret Stealer Exploits Stolen Tokens and Covers Its Tracks","2026-11-12T08:20:22.031+00:00",{"slug":30,"title":31,"published_at":32},"ai-agents-disable-their-own-safety-monitoring-and-lie-about-it","AI Agents Disable Their Own Safety Monitoring and Lie About It","2026-10-21T18:22:11.015+00:00",{"slug":34,"title":35,"published_at":36},"ai-agents-disabled-their-own-safety-monitoring-and-lied-about-it","AI Agents Disabled Their Own Safety Monitoring and Lied About It","2026-10-21T18:21:49.766+00:00",{"slug":38,"title":39,"published_at":40},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":42,"title":43,"published_at":44},"marklogic-flaws-let-limited-users-seize-persistent-admin-control","MarkLogic Flaws Let Limited Users Seize Persistent Admin Control","2026-10-13T10:20:46.693+00:00",{"slug":46,"title":47,"published_at":48},"atm-jackpotting-malware-driven-cash-theft-highlights-physical-and-cyber-atm-security-gaps","ATM Jackpotting: Malware-Driven Cash Theft Highlights Physical and Cyber ATM Security Gaps","2026-10-02T16:20:41.59+00:00",{"slug":50,"title":51,"published_at":52},"gdpr-article-31-self-incrimination-rights-vs-regulatory-cooperation-obligations","GDPR Article 31: Self-Incrimination Rights vs. Regulatory Cooperation Obligations","2026-09-30T16:20:39.146+00:00",{"slug":54,"title":55,"published_at":56},"settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","2026-09-17T18:21:03.162+00:00",{"slug":58,"title":59,"published_at":60},"spains-aepd-rules-ministry-of-defence-violated-gdpr-by-withholding-health-data-access-logs","Spain's AEPD Rules Ministry of Defence Violated GDPR by Withholding Health Data Access Logs","2026-09-15T18:21:41.527+00:00",{"slug":62,"title":63,"published_at":64},"spains-aepd-blanket-refusal-to-disclose-health-data-access-logs-violates-gdpr-article-15","Spain's AEPD: Blanket Refusal to Disclose Health Data Access Logs Violates GDPR Article 15","2026-09-15T16:22:14.189+00:00",{"slug":66,"title":67,"published_at":68},"spains-aepd-finds-ministry-of-defence-violated-gdpr-patient-data-access-rights","Spain's AEPD Finds Ministry of Defence Violated GDPR Patient Data Access Rights","2026-09-10T16:21:15.194+00:00",[70,75,80,85,90,94],{"slug":71,"name":72,"problem":73,"stories":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",14,{"slug":76,"name":77,"problem":78,"stories":79},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",8,{"slug":81,"name":82,"problem":83,"stories":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":86,"name":87,"problem":88,"stories":89},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,{"slug":91,"name":92,"problem":93,"stories":89},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":95,"name":96,"problem":97,"stories":89},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[99,105,110,115,119,123,128,132],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","8","Control 8","Audit Log Management",19,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",17,{"family":100,"item":111,"code":112,"title":113,"together":114},"3","Control 3","Data Protection",10,{"family":5,"item":116,"code":117,"title":118,"together":114},"ac-2","AC-2","Account Management",{"family":5,"item":120,"code":121,"title":122,"together":114},"ac-6","AC-6","Least Privilege",{"family":100,"item":124,"code":125,"title":126,"together":127},"12","Control 12","Network Infrastructure Management",9,{"family":100,"item":129,"code":130,"title":131,"together":79},"7","Control 7","Continuous Vulnerability Management",{"family":100,"item":133,"code":134,"title":135,"together":84},"13","Control 13","Network Monitoring and Defense"]