CryptoConsortium / CCSS

The CryptoCurrency Security Standard
https://cryptoconsortium.github.io/CCSS/
139 stars 79 forks source link

2.04 Audit Logs: All admin actions should be logged in L1 #30

Open mperklin opened 7 years ago

mperklin commented 7 years ago

Following the audit of an information system, it became clear that all administrative actions within the system should have been logged to ensure retention of valuable information.

Section 2.04 currently states the following for L1 compliance:

Audit trails exist for a subset of actions that are performed within the information system. Examples of this would include recording audit information of all withdrawals and deposits made with the system.

This should be changed to something similar to

Audit trails exist for all administrative actions that are performed within the information system. Examples of this would include recording login/logout times of admins, or balance adjustments to accounts within an off-chain exchange