Hotel, café, school, office, building management: every place that offers internet access to its guests or employees runs into the question at some point: “where are our records, who looks at them, can we find them when needed?” This article looks at that question from a process point of view: what happens in daily operation, which record is kept for what, and which concepts become important afterwards.
This article is for general information and contains no legal assessment. For questions such as what your organization’s obligations are and which periods apply, you should consult your legal adviser or the relevant official sources.
Daily operation: the trace of a connection
When a user connects to your network, two things happen. First, the network gives the device a temporary address; then the device browses the internet with that address. The firewall can produce a record of outbound connections as it lets them through. So the trace of a connection sits in two separate places: in the address assignment records and in the outbound traffic records.
Which record is kept for what?
Outbound traffic records. They show which address connected to which destination, at what time. On its own it is an “address” record; it does not say who it was.
DHCP records. This is the record kept by the service responsible for address assignment: which address was given to which device, during which time interval? Because the same address may have been given to different devices during the day, without this record a traffic record often cannot be linked to a person or a device.
When the two are read together, this sentence can be formed: “The address that connected to this destination at this time was on this device at that moment.” On guest networks, whether there is an additional step that identifies the user (for example a welcome page) also affects the strength of this link.
Three concepts: retention, integrity, querying
Retention. How long records will be kept, where they will sit and what happens when the disk fills up should be planned from the start. The period depends on legislation and your organization’s situation; this article does not recommend a period. Practical questions to ask are: is the retention period written down, who set it, can records be deleted before the period ends?
Integrity. Someone with access to the record files can change the content, knowingly or by mistake. The common way to show integrity is to produce a digest of the file with an algorithm such as SHA-256 and to seal this digest with a trusted timestamp (RFC 3161). This helps show that the record has not changed since that moment. How often the sealing is done also matters; the longer the interval, the longer the period left unsealed.
Querying. Records are kept not only to sit there but to be found when needed. In the archive you have, can you give an address and a time and get a result? Can you do this without depending on one person, in a clear record format? If querying is tried for the first time at the moment of need, it is open to surprises.
Five questions to start with
- Does our firewall record outbound traffic, and where do these records go?
- Are address assignment (DHCP) records kept as well?
- Are the clocks of the two records set against the same source?
- Is the retention period written down, and are the records protected during that period?
- Given an address and a time, can we really pull out the relevant record?
Answers of “no” or “I don’t know” are not an alarm; they are an improvement list. The starting point is usually to see where the record flow goes.
LogKeeper Pro
LogKeeper Pro is the log management software developed by 7 Tepe, and it addresses the concepts above with this message: Identify · Prove · Test.
- Identify: It identifies whose record it is.
- Prove: It seals the records with a timestamp and a digest.
- Test: When an off-site copy target is defined, it tests periodically and automatically whether the restore works.
Its scope is deliberately narrow: only outbound traffic and DHCP records. The default retention period is 730 days; this is the product’s default setting and is not a statement of any statutory period. The product installs on your existing server. You can contact us for details, a demo and a quote.
Also on this topic: The difference between keeping a log record and proving the record
Would you like to review your record flow? See the LogKeeper Pro page: LogKeeper Pro
