SRS-057: Security Event Auditing

Identifier

SRS-057

Software System

• User Management Service
• API Gateway
• Security Anomaly Detection Service
• Audit Service

Category

• Security
• Functional

Description

The software shall specifically record all significant security-related events to ensure that potentially malicious or unauthorized activities are logged for later review.

1. Changes to permissions: Any change to a user's roles or permissions shall be recorded. The audit entry shall include the identity of the administrator making the change, the identity of the affected user, and the specific change made.
2. API Key management: The creation or revocation of API keys shall be recorded. The audit entry shall specify the user who performed the action and the identifier of the API key affected.
3. Detected security anomalies: Any security anomaly detected by the system (e.g., repeated failed logins from a single IP, attempted access to unauthorized resources) shall be recorded. The entry shall include all relevant contextual data about the detected anomaly.

Derived from PRS

• PRS-0MC: Comprehensive secure audit trails for user interactions

Risks related to the SRS

Risks that are caused by the requirement

Risks to which the requirement is the solution (mitigation or control)