A09: Security Logging and Monitoring Failures · 2021
Missing logs, monitoring and alerts prevent timely attack detection, investigation and response.
Summary
Missing logs, monitoring and alerts prevent timely attack detection, investigation and response.
How the attack works
An attacker abuses a sensitive operation; missing logs and alerts prevent timely detection and response, allowing the abuse to continue.
Example
Vulnerable · Pseudocodeif not valid_login(user):
return 401
# No security event or alertFix: Log failures without secrets and alert on suspicious patterns.
Prevention
- Log relevant authentication, authorization, validation and errors.
- Centralize logs and protect them against tampering or unauthorized access.
- Create actionable alerts and regularly test incident response.
Lineage
- 2017 · A10: Insufficient Logging & Monitoring Renamed and moves up in 2021
- 2021 · A09: Security Logging and Monitoring Failures Renamed from A10:2017
- 2025 · A09: Security Logging & Alerting Failures Monitoring changes to Alerting
- 2017:A10 → 2021:A09: Logging and Monitoring is renamed and moves up one rank.
- 2021:A09 → 2025:A09: Monitoring changes to Alerting.