Ben Wright over at Hack-i-gations posted a short piece on Instant Message (IM) logging. I asked him about this when I took his SANS class earlier this year and he gave me pretty much the same answer he gave in this post: Logs are good. Have lots.
Instant Messaging creates logs therefore those logs should be retained. That got me thinking about the IM logging again and here are my thoughts on IM logging and its impact on legal issues and public relations.
The counter argument to logging everything is what I will call the “Ignorance is Bliss” school of instant messaging logging. The general thought process here is that if you don’t know about it you don’t have to deal with it. This is a technique one could use, but the flaw in it that I see is that an IM conversation is a two way street. You might not have a copy of the IM conversation, but there is a chance that the guy on the other end does. If you go to court over an IM conversation and the other guy provides a copy of an IM conversation that appears to have been modified in his favor, what do you do? The “Liar, liar, pants on fire” argument probably won’t hold up real well if you don’t have evidence to support your side of the story. Proving you didn’t modify your logs and he did is another discussion.
The other problem I see with the “Ignorance is Bliss” approach stems from some non-technical concerns, primarily public perception. A victory in court could very well be dulled by a defeat in the court of public opinion. Failing to maintain IM logs could create the impression that an organization didn’t know enough to log the transactions. If you counter that impression by saying that you considered logging IM conversations but decided not to based on legal considerations, you look shiesty to the public.
Extreme opinions on shiesty corporations is prime blog fodder. The last thing your reputation needs is a massive herd of disgruntled bloggers drawing the attention of CNN. Little did I know that information security decisions would have such potential impact on public relations matters.
So, what do you do? My gut feeling, which Ben affirmed at the class, is to embrace Public Relations Judo. Accept the attack, but redirect its energy. If there is a security event that generates bad press, acknowledge the negative aspect and accept responsibility. After you have accepted responsibility, publicize your remediation plan and solicit the community for help so that others will not fall victim to the same error. Acceptance of responsibility and development of corrective action tends to defuse most of the bad press. By reaching out and asking other for help to prevent others from making the same mistake, you are acting as an upstanding member of the community. Who can stay mad at an upstanding member of society?
As a disclaimer, I’m not a lawyer or PR professional and real life has a blatant disregard for theory, so your mileage may vary. But I think it’s a good place to start.
Comments are welcome!
Technorati Tags: security, logging, legal, law, PR, public relations
Filed under: Logging, PR, Security, law, legal | 2 Comments »