Computer Security Threat Monitoring and Surveillance

In most systems such data is not collected. This is because the
systems are generally large with a large number of users, and
recording the presumed attempted logons would consume too many
system resources to warrant their acquisition.
In addition there is a potential problem created by recording in
the audit data unsuccessful logons if those logons contain the password
or other user authenticator. The danger is that the audit trail
will contain partial or complete user authenticators or passwords
from legitimate errors made by authorized users as well as the un­
successful external penetration attempts. This is not to say such.
data should not be collected, it is only to point out that in the
collection it is possible that a greater danger is created.
Auditing of attempted logons can include identification of the
terminal, the port through which the terminal is connected to the
system, and the claimed ide."ltity of the user and the like. If the
assets required it, it would·be possible to trigger an immediate
exception report to the security officer or other operations personnel
if the number of unsuccessful longons from a given port number ex­
ceeded some threshold over time. The cost of this idea is the
additional complication of maintaining logon records or even extracts
from l.ogon records on a per-port basis when the number of ports or the
number of potential users of the system is extremely large. Note that
the external penetrator threat translates into an internal threat
as soon as the installation access controls have been penetrated.
-10­