A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?
A security administrator needs to review events from different systems located worldwide. Which of the following is MOST important to ensure that logs can be effectively correlated?
B. Logs should be synchronized to a common, predefined time source. Explanation: Log synchronization to a common, predefined time source (such as using NTP - Network Time Protocol) ensures that all logs from different systems, regardless of their geographical location, use the same reference time. This is crucial for correlating events accurately across multiple systems worldwide, as discrepancies in time could make it difficult to piece together the sequence of events or detect incidents in real-time.