For user identification in log entries, what must be included?

For user identification in log entries, what must be included?

• A. User identification is included in log entries.
• B. Password hashes must be stored in logs.
• C. Logs should only contain success/failure status.
• D. Logs should omit user identifiers to protect privacy.

Answer: (A)

Tracking who performed each action in logs is essential for security audits and incident response. When a log entry includes the user identity, you can trace every event back to a specific person or service account, which provides accountability and enables you to investigate, reproduce, and respond to incidents involving cardholder data. PCI DSS requires that logs capture access to network resources and cardholder data with clear identification of the user who initiated the action, along with when the action occurred and what happened. This makes it possible to determine who did what, when, and with what result. Storing password hashes in logs isn’t appropriate because logs should protect credentials and avoid exposing sensitive credential material. Logs shouldn’t be reduced to just a success/failure status either; without the user identity, you lose the ability to attribute actions to individuals. Likewise, omitting user identifiers to protect privacy would undermine traceability and accountability, which PCI DSS emphasizes for maintaining secure environments.

Tracking who performed each action in logs is essential for security audits and incident response. When a log entry includes the user identity, you can trace every event back to a specific person or service account, which provides accountability and enables you to investigate, reproduce, and respond to incidents involving cardholder data. PCI DSS requires that logs capture access to network resources and cardholder data with clear identification of the user who initiated the action, along with when the action occurred and what happened. This makes it possible to determine who did what, when, and with what result.

Storing password hashes in logs isn’t appropriate because logs should protect credentials and avoid exposing sensitive credential material. Logs shouldn’t be reduced to just a success/failure status either; without the user identity, you lose the ability to attribute actions to individuals. Likewise, omitting user identifiers to protect privacy would undermine traceability and accountability, which PCI DSS emphasizes for maintaining secure environments.