Network auditing: issues and recommendations

Auditing can be used to detect abuse or intrusion into a computer system in some cases or if the abuse or intrusion is discovered by other means, the audit can be used after-the-fact to help determine the amount of damage that has occurred on the system. The deterrent presented by the audit trail is also important. In the past, audit trails have usually been oriented to standalone processors. The paper explores issues present when auditing in a networked environment. The issues are grouped according to: collection and storage, integration, protection and analysis. Some recommendations for further research, development, standards and policy-making initiatives are provided