Take the 2-minute tour ×

When running in a configuration that supports Common Criteria, Windows must be configured to shut down when the security event log is full. Why is this a preferable option?

share|improve this question
add comment

1 Answer

Simply put, the Integrity of the system is more valuable than its Availability.

This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place.

The alternative would allow someone to generate spurious security event log messages, then when the log was full, perform an actual attack and breach the system somehow, without it being logged because the log was full.

share|improve this answer
Of course, then by preventing a theoretical security issue you create a very simple and reproducible denial-of-service exploit (by design). Wouldn't it be fun if causing the server to shut down you actual enable an attack against another machine. Oh security is fun. –  tylerl Sep 23 '12 at 7:40
@tylerl Given how cheap storage is nowadays, the simple solution would be to always ensure enough that there is enough storage for logging. –  Terry Chia Sep 23 '12 at 7:49
@TerryChia which then makes this whole discussion moot –  tylerl Sep 23 '12 at 8:03
Or simply configure the system to delete logs from the file when it gets above a certain percent full. –  GdD Sep 23 '12 at 12:10
I'm reminded of Stephen Northcutt's story about how, many years ago, while consulting for the Navy, he told the base commander that they were under a Denial-of-Service attack but were handling it without downtime; the base commander ordered him to take them off the Internet immediately as a protective measure. –  gowenfawr Sep 23 '12 at 14:16
show 2 more comments

Your Answer


