[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-573290-105":3,"detail-sidebar-cat-1-en-105":80,"doc-detail-573290-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","towards-understanding-and-improving-security-relevant-web-application-logging","Towards Understanding and Improving Security-Relevant Web Application Logging","","Security-relevant event logging is essential for gaining visibility during software runtime and for detecting suspicious, malicious behavior. Multiple standards and guidelines, including ISO 27002 and CCM, require logging for forensic purposes, while the OWASP community provides similar recommendations. This paper examines insufficient security logging by mapping requirements from six guidelines and studying real-world practices in 472 open-source Java web applications, totaling 33K+ security-relevant statements across event categories. Results show security logs are not differentiated from general logging, and current practices lack effectiveness for detection and investigation, highlighting the need for more practical guidelines and automated support for developers.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/towards-understanding-and-improving-security-relevant-web-application-logging/573290/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/towards-understanding-and-improving-security-relevant-web-application-logging/573290.png","ImageObject",442,249,{"name":42,"@type":43},"kopisore","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-18","2026-10-14",true,{"@type":52,"interactionType":53,"userInteractionCount":26},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"Why is security-relevant web application logging important?","Question",{"text":62,"@type":63},"It provides visibility into application runtime activities, supports detection and investigation of security incidents, and helps with forensic analysis and compliance evidence.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How does the paper study security logging practices?",{"text":67,"@type":63},"It derives security-relevant logging requirements from six security guidelines and analyzes real-world logging in 472 open-source Java web applications, identifying 33K+ security-relevant logging statements by event category.",{"name":69,"@type":60,"acceptedAnswer":70},"What do the results indicate about current security logging practices?",{"text":71,"@type":63},"Security log handling is not meaningfully differentiated from general logging, and the observed practices are insufficient to enable effective detection and investigation of security-related issues.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},573290,1792359622,{"code":4,"msg":81,"data":82},"success",[83,87,92,97,102,107,112,117,122],{"id":84,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":85,"slug":86},11,90,"presentations",{"id":88,"doc_module":22,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},12,"Resumes",80,"resumes",{"id":93,"doc_module":22,"doc_module_name":25,"category_name":94,"show_sort_weight":95,"slug":96},14,"Invoices",70,"invoices",{"id":98,"doc_module":22,"doc_module_name":25,"category_name":99,"show_sort_weight":100,"slug":101},15,"Posters",60,"posters",{"id":103,"doc_module":22,"doc_module_name":25,"category_name":104,"show_sort_weight":105,"slug":106},16,"Social Media",50,"social-media",{"id":108,"doc_module":22,"doc_module_name":25,"category_name":109,"show_sort_weight":110,"slug":111},17,"Forms",40,"forms",{"id":113,"doc_module":22,"doc_module_name":25,"category_name":114,"show_sort_weight":115,"slug":116},18,"Letters",30,"letters",{"id":118,"doc_module":22,"doc_module_name":25,"category_name":119,"show_sort_weight":120,"slug":121},21,"Paper Templates",5,"papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":81,"data":127},{"doc_id":78,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":84,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":26,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":103,"language":135,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":12,"update_tm":139,"read_time":140},962090880963,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Towards Understanding and Improving Security-Relevant Web Application Logging  \nMerve Sahin, Noemi Daniele  \nSAP Security Research  \n[merve.sahin@sap.com](merve.sahin@sap.com), [noemi.daniele@sap.com](noemi.daniele@sap.com)  \nABSTRACT  \nLogging of security-relevant events is crucial in software development to gain visibility into the application’s runtime, and to detect suspicious and malicious behavior. Various security guidelines (such as ISO 27002, CCM) mandate the software products to log certain security-relevant events for forensics purposes. In addition, security community (such as the OWASP Foundation) has come up with similar logging recommendations. On the other hand, the lack of sufficient and proper logging practices has been common in the software industry: In fact,“insufficient logging and monitoring” has been part of the OWASP Top 10 web application security risks for many years.  \nIn this paper, we address the issue of insufficient security logging by identifying the security-relevant logging requirements from multiple security guidelines, and by looking at real-world logging practices in a large set of open source Java web applications. We analyze six logging guidelines and identify more than 33K securityrelevant logging statements from 472 applications, with respect to different event categories. We present several observations on the log density, positioning, severity levels, use of logging utilities, and the common motivations for security-relevant logs. Our results show that the handling of security logs is not differentiated from the rest of the logging activity, and the current practices are not sufficient to facilitate the detection and investigation of security related issues. Finally, we draw attention to the need for more practical logging guidelines and automated tools to support developers in logging decisions.  \nACM Reference Format:  \nMerve Sahin, Noemi Daniele. 2024. Towards Understanding and Improving Security-Relevant Web Application Logging. In ACM Asia Conference on Computer and Communications Security (ASIA CCS’24), July 1–5, 2024, Singapore, Singapore. ACM, New York, NY, USA, 16 pages. [https://doi.org/](https://doi.org/)[ ](https://doi.org/)10.1145/3634737.3637647  \n1 INTRODUCTION  \nAirplanes are deployed with flight recorders that record the cockpit audio and flight data from various sensors. These devices provide invaluable information in case of a plane crash to understand what went wrong and how the mistakes can be avoided next time.  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific [permission and/or a fee. Request permissions from permissions@acm.org](permission and/or a fee. Request permissions from permissions@acm.org).  \nASIA CCS’24, July 1–5, 2024, Singapore, Singapore  \n© 2024 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 979-8-4007-0482-6/24/07  \n[https://doi.org/10.1145/3634737.3637647](https://doi.org/10.1145/3634737.3637647)  \nApplication-layer software logging is of similar importance: It provides valuable information about the activities and events that occur during an application’s runtime [49] . One of the main motivations for application-layer logging is to collect the securityrelevant events. This data enables the detection and investigation of security incidents (e.g., forensic analysis), and can be used to prove compliance with security standards or regulations (e.g., asan audit trail) [21] .  \nIn this paper we focus on the security-relevant logging in web applications,","cbCaibQnjnqAM8ry","https://ap.wps.com/l/cbCaibQnjnqAM8ry","pdf",221099,"English","# Introduction\n## Motivation and background\n## Security logging requirements and failures\n## Limitations of access logs","[{\"question\":\"Why is security-relevant web application logging important?\",\"answer\":\"It provides visibility into application runtime activities, supports detection and investigation of security incidents, and helps with forensic analysis and compliance evidence.\"},{\"question\":\"How does the paper study security logging practices?\",\"answer\":\"It derives security-relevant logging requirements from six security guidelines and analyzes real-world logging in 472 open-source Java web applications, identifying 33K+ security-relevant logging statements by event category.\"},{\"question\":\"What do the results indicate about current security logging practices?\",\"answer\":\"Security log handling is not meaningfully differentiated from general logging, and the observed practices are insufficient to enable effective detection and investigation of security-related issues.\"}]","Towards Understanding and Improving Security-Relevant Web Application Logging | PDF",1791936659,6]