Overview
The goal of the new access logging feature is to be able to ascertain access information for a given users and accounts within the axis tool. This will allow us in the future to determine a threshold that if passed will create an alert that there is a security incident at play.
NOTE: This is a temporary solution, a longer term solution with data storage in Google needs to be in place prior to Parks onboarding to Axis in FY17 Q3.
|
Goals
- Track the following information:
- Where a user is attempting system access from.
- When a user performed a specific action
- What action was performed
- This could be anything from loading an account by swid to performing a search.
- where in the tool the action took place from
- What product was involved
- What account was accessed
- Encrypt sensitive information at rest
- AES 256 with a rotating key will be used.
- fields to encrypt
- externalKey (This is the accountId or SWID)
Table: access
| Column | Type | Example | Encrypted | Index | Description |
|---|---|---|---|---|---|
| access_id | INT | 1 | no | Primary | The primary Id of the table (autoincrement) |
| user_id | SMALLINT | 270 | no | MUL | Correlates to the gxtools.users table outside of this database. (FK to internal user records ID, NOT the actual DISID/HUBID) |
| time | INT | 1474568116 | no | MUL | The time of the access log in seconds |
| action | VARCHAR(64) | account.get | no | The action that was performed. Example:
This list will be dynamic as we add functionality to these logs, best way to find the definitoive actions would be to: select unique action from access; | |
| external_key | VARCHAR(128) | ImFvCKxykUjN299P9/Dvh+qnepY+u1RW2p8qtvOqnpyVLIXJrIb0pDTgPtbdGjLIVUh2eZ570k/5GPBIzl2kUw== | yes | MUL | An encrypted swid or relation key depending on the action logged. ** AES256 w/ rotating key, stored in Vault. |
| product_id | SMALLINT | 14 | no | Correlates to the gxtools.products table outside of this database. | |
| ip | VARCHAR(44) | 255.255.255.255 | no | MUL | A Encrypted string IP address of the support rep accessing the tool. |
| location | VARCHAR(128) | com.disney.axis.account.service.OneIdAccountService | no | The package in the code that the action took place. Used to refine the action to different implementations. | |
| request_id | VARCHAR(36) | ajsdkfyy-4u1io2-asdfhjio134-12i3uji1u23 | no | The request id that we assign requests made to the tool. Correlates to the requests made to external services and errors |
Log Locations
The log files are located on the database servers for each respective environment.
