This tutorial offers guidance on the importance of event security audits and how to configure the logging and signing of various events on the Unifyia platform to ensure compliance and detect vulnerabilities. The Security Audit feature enhances visibility and control, empowering organizations to manage potential risks while preserving compliance and data integrity.

Overview

A security audit is a crucial process for maintaining the integrity and safety of your systems and data. By configuring event security audits, organizations can ensure compliance with security standards and proactively identify vulnerabilities. This feature allows administrators to define which events should be logged and/or signed with the digital signature certificate of the logged-in user. This provides a comprehensive record of system activities for auditing and monitoring purposes.

Advantages of the Security Audit

• Customizable Event Logging: Administrators can configure which specific events within the system need to be logged. This ensures that critical actions, such as user logins, data modifications, or system changes, are captured for review.
• Digital Signature Integration: To enhance the authenticity and integrity of the logged events, each entry can be signed with the digital signature certificate of the logged-in user. This guarantees that the logged event is verifiable, tamper-proof, and securely tied to the user's identity.
• Compliance Assurance: Configuring event logs with appropriate security measures helps ensure compliance with regulatory requirements and industry standards, such as GDPR, HIPAA, or PCI-DSS, which often mandate detailed event auditing.
• Vulnerability Detection: By systematically auditing events and actions across the system, organizations can identify unusual or unauthorized activities, enabling swift detection of security vulnerabilities or breaches.
• Enhanced Security Posture: Event security audits help reinforce overall security posture by providing transparency, accountability, and a clear audit trail for further investigation and action in case of a security incident.

Prerequisites

• The option Enable Digital Signing under General Settings must be enabled. To do this, navigate to Configurations > General Settings > Policies and Settings. Activate the Enable Digital Signing policy to allow event data to be signed using the PIV Digital Signature certificate of the logged-in user.
• Administrator credentials to login to the Unifyia platform

Configure Event Logging and Signing

Login to the Unifyia platform using administrator credentials. On the dashboard, go to Configuration > Security Audit to view the list of events. Each event entry includes its name and the conditions that trigger it. You will see two toggle buttons for each event: one for logging the event and another for signing the event.

The Sign Event option becomes available only when Log Event option is enabled; an event cannot be signed without being logged. To enable logging or signing for an event, slide the toggle to the right. To disable it, slide the toggle to the left.

To search an event, type the name of the event in the search box. It displays the names of the available events.

The following sections list the events that can be logged and signed. They are divided into three logical sections - Configuration and Integration Events, User Management Event, and Credential Management Events for better management.

Configuration and Integration Events

The events listed under this section are generally administrative events and are managed by administrators. The following table includes saving, updating, and deleting events that can be configured for security audit.

User Management Events

The events listed under this section are typically related to the user onboarding, enrollment, approval.

Credential Management Events

This section lists events related to the granular lifecycle management of issued credentials by both operators and users. These events are triggered at the identity device, application, and credential levels.