Mmastodon TechnologyCybersecurity first seen 6 d ago, last 6 d ago, peak #2
NCSC guidance on log retention gaps under scrutiny
Original: An intrusion discovered today may have started months ago. The NCSC tells you to size the log window to that gap, initia
The UK's National Cyber Security Centre is advising organisations to size their log retention to the worst-case gap between initial compromise and detection — cited as 13 months for critical systems and 180 days for other environments. Security professionals are pointing out that rotating logs every 30 days makes it impossible to reconstruct an intrusion discovered later, prompting debate about whether most organisations' retention practices fall far short of what incident response actually requires.
Why now: Cybersecurity practitioners are debating whether common short log rotation windows leave organisations unable to investigate breaches discovered months later.
National Cyber Security CentreUK
Evidence
- An intrusion discovered today may have started months ago. The NCSC tells you to size the log window to that gap, initial access to detection: 13 months for critical systems, 180 days otherwise. Rotate at 30 days and you can only reconstruct the last month. How fast logs leave… · adrianhollister@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/3001559