In this series:
What should the logging include?
Effective logging should cover several aspects of data access and use to ensure full traceability:
Who Accessed: Identification of the user (including their role or permissions) attempting to access information. This includes both internal users and external parties, such as consultants or suppliers. The log must also be able to be linked to the individual's authentication method (e.g. password, two- factor authentication).
When Accessed: Exact timestamps for each access attempt or data transaction. By knowing when a specific action occurred, the organization can quickly identify suspicious or unauthorized access attempts during irregular hours, such as outside regular business ho
From where the access was made: Information about the location or device where the access took place, such as IP address, network location or the device used (eg mobile, computer or tablet). This makes it possible to trace whether the access was made from secure networks or from potentially unsafe or unauthorized locations.
What the user has done with the data: It is not only important to know that someone has gained access to the data, but also what they have done with it. Logging should include which files or data have been accessed, modified, shared, copied or deleted. This provides a complete picture of user activity and can help identify potentially malicious behaviour, such as copying large amounts of data or sharing sensitive information with unauthorized parties.
Security incidents and investigation
Compliance and reporting
In many industries, particularly in the public sector, finance and healthcare, organizations are required to comply with specific laws and regulations that require traceability. Examples of such regulations include the General Data Protection Regulation (GDPR), which requires organizations to be able to demonstrate that personal data is handled securely and that all access attempts to this data are documented. Logs help organizations meet these requirements by providing a history of how data has been handled and by whom.
If an organization suffers a security incident where sensitive information is compromised, it is often required to report to regulatory authorities. Clear and detailed logs enable the organization to quickly compile the necessary information and prove that appropriate measures have been taken to protect data. This can reduce fines and other penalties and improve the trust of customers and business partners.
Automation and analysis
Many modern security systems use automated logging and analysis tools to quickly detect anomalies
in user behavior and potential security threats. For example, such systems can warn if a user suddenly
starts downloading unusually large amounts of data, or if access attempts are made from an unusual
location. Automated incident response can also be used to block access immediately if a potential
breach is detected, limiting damage before it escalates.
The role of logging in auditing and security improvement
Logs also play an important role in regular security audits. Organizations can use log data to analyze
access patterns, identify weaknesses in access controls, and adapt their security policies over time. By
regularly reviewing logs, potential security flaws can be discovered and fixed before they are exploited
by unauthorized persons.
Strong encryption is a fundamental security measure to protect sensitive information, both when it is stored and when it is transmitted. Encrypting data ensures that even if information is stolen or lost, it cannot be read by unauthorized persons. Encryption should be used on all sensitive data, and organizations should regularly update their encryption methods to stay in line with the latest security standards.
Regardless of whether the encryption takes place on a local file server or in a public cloud service, it is important to meet the requirements for HYOK (Hold Your Own Key). With HYOK, the organization gains complete control over its data by creating, storing and managing the encryption key itself. This key is protected by an HSM (Hardware Security Module), which ensures that the key is stored and handled in a very secure manner.
By using its own encryption key, the organization can protect its data independent of third-party providers, and thus has full ownership and control over the data. This means that the encryption key can be stored in Sweden, under Swedish sovereignty and legislation, which is crucial to ensure compliance with local regulations and protection against foreign jurisdictions.
An important protection that HYOK offers is that it prevents, for example, a cloud provider from being forced to release data under laws such as FISA (Foreign Intelligence Surveillance Act) in the US, because the provider does not have access to the encryption key. Additionally, HYOK prevents the cloud provider's administrators, or a potential attacker who steals their keys, from accessing the organization's data. Keeping control of its own encryption key minimizes the risk of unauthorized access and ensures that no one but the organization itself can decrypt and access the sensitive information.
Complior
Ensuring a robust secure storage solution requires not only technical solutions but also compliance with legal and regulatory requirements. By using modern methods of encryption and key management, companies and organizations can guarantee full control over their data, whether it is stored locally or in a public cloud service.
Complior offers a wide range of security services for organizations that want to protect their most sensitive data. Through its PCI DSS certified cloud infrastructure and services such as HSM and Key Management Systems (KMS), companies can easily implement secure solutions for storage, key management and compliance with regulations such as GDPR and PCI DSS, DORA, NIS2.
Complior offers a complete solution for secure storage through encryption and key management, whether on-premises or in the cloud. Our strong partnership with archTIS has expanded our solutions with NC Protect and NC Encrypt, which enable customers to automatically classify and protect unstructured data in Microsoft 365 and other environments. Through HYOK (Hold Your Own Key) and integration with local KMS, customers gain full control over their encryption keys, ensuring data sovereignty and protection.
