Page 1395 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Guidelines suggest logging the following events:

Input validation failures

Authentication attempts, especially failures
Access control failures

Tampering attempts

Use of invalid or expired session tokens

Exceptions raised by the operating system or applications

Use of administrative privileges

Transport Layer Security (TLS) failures

Cryptographic errors

This information can be useful in diagnosing security issues and in the
investigation of security incidents.

Fail-Secure and Fail-Open In spite of the best efforts of
programmers, product designers, and project managers, developed
applications will be used in unexpected ways. Some of these conditions
will cause failures. Since failures are unpredictable, programmers
should design into their code a general sense of how to respond to and
handle failures.

There are two basic choices when planning for system failure:

The fail-secure failure state puts the system into a high level of

security (and possibly even disables it entirely) until an
administrator can diagnose the problem and restore the system to
normal operation.

The fail-open state allows users to bypass failed security controls,
erring on the side of permissiveness.

In the vast majority of environments, fail-secure is the appropriate
failure state because it prevents unauthorized access to information

and resources.

Software should revert to a fail-secure condition. This may mean
closing just the application or possibly stopping the operation of the