Security Log Management: What to Log, How Long to Keep It, and How to Protect It

Security logging provides the evidence trail for detecting and investigating incidents — but only if logs capture the right events, are retained long enough, and are protected from tampering. Best practices: log all authentication events (successful and failed), authorisation decisions, configuration changes, data access events, error conditions, and administrative actions. Retention should meet regulatory requirements (typically 1-7 years depending on framework). Logs should be forwarded to a centralised, tamper-resistant system (SIEM) with access restricted to security personnel.