You are using an out of date browser. It may not display this or other websites correctly. You should upgrade or use an alternative browser.
compliance monitoring
About this tag
Compliance monitoring on WindowsForum.com covers the use of auditing tools to detect gaps in system logging that could affect regulatory or internal policy compliance. A recent discussion highlights a Linux kernel patch addressing missing audit coverage for getxattrat() and listxattrat() syscalls, which allowed extended attribute reads to bypass file-read audit rules. This example underscores the importance of keeping audit rule sets complete to avoid blind spots in logs, especially for security-related attributes. While the specific thread focuses on Linux, the broader theme of ensuring audit systems accurately capture all relevant file access events is relevant to compliance monitoring across operating systems, including Windows environments where similar auditing gaps can occur.
A recent upstream Linux kernel patch fixed a silent but important auditing gap: the "at" variants of two extended-attribute read syscalls—getxattrat() and listxattrat()—were not listed in the kernel's audit read class, allowing reads of extended attributes to bypass file-read audit rules on...