...
Data is also logged regarding what software is executed, where, and when, via keyserver software, /wiki/spaces/itskb/pages/26129581. We do this, when needed, for audit and compliance purposes. General information at this level is visible to a handful of people including desktop computing and software asset management specialists, the IT security officer, and the data warehouse administrator.
Authentication
All attempts at authenticating are logged, not only by individual computers, but also by enterprise applications (e.g., Colleague, OnBase, Advance, Slate, the Carleton website), domain controllers, our web-based login pages, and associated dual-factor authentication services (Duo). We need to record who logged in, when, and from where in order to be sure the people logging in are who they say they are, and to detect compromised passwords and general scanning and hacking attempts. Access to this data is limited to application managers and/or to a few core systems staff and the IT security officer.
Network-Level Logging
In general, nearly all devices through which Carleton network traffic passes on Carleton’s network log that traffic. These logs typically include the source and destination IP address, MAC address, and various other relevant details. Additional detail gets logged for WiFi via via /wiki/spaces/itskb/pages/26119999. This data, collectively, allows us to locate and fix problems and bottlenecks, and it helps us diagnose problems when we (or our users) discover them. We normally don’t look at this data in detail unless there is a problem. The number of people who can do this is very limited (a few core systems staff and the IT security officer).The Firewall
Additionally, ITS protects the campus with a central firewall, which inspects traffic as it flows through and looks for infiltration attempts, brute-force scans of our network, and other hostile activity, and logs and/or outright blocks the activity, depending on its severity. ITS does not examine logs produced by the firewall, except when performing forensics or examining alert notices. The number of people who can do this is very limited (a few core systems staff and the IT security officer).
Machine-Level Logging
Individual machines (Linux servers, Windows servers, and Windows desktops) also log what they are doing, locally. There are, for one thing, antivirus and local firewall logs. There are also general system logs. These latter logs are written not only to local disk, but also forwarded to a central syslog server, then on to a central repository (Splunk). Every time a Windows machine executes a program, it is also recorded separately, along with the policy that applies to it (AppLocker). ITS knows nothing about what the programs are really doing. But we do use the basic information provided in logs to detect malware-related infestations, and also to perform forensics when and if hostile activity is discovered.
...