security-logging-alerting-failures
Installation
SKILL.md
A09:2025 — Security Logging & Alerting Failures
OWASP rank: #9 (community-voted for third consecutive cycle)
Renamed in 2025: Added "Alerting" — logging without alerting provides minimal security value.
Stats: 5 CWEs, 723 CVEs, 3.91% average incidence rate
Coverage CWEs: CWE-778, CWE-117, CWE-532, CWE-223, CWE-390
What This Category Covers
| Failure Type | Description |
|---|---|
| Insufficient Logging | Auditable events (logins, access control failures, validation errors) not logged |
| Log Injection | User input flows unescaped into log messages — enables log forgery |
| Sensitive Data in Logs | Passwords, tokens, PII, card numbers written to log output |
| Omission of Security-Relevant Info | Errors/warnings logged without context (IP, user, timestamp, action) |
| No Alerting | Logs exist but no thresholds, rules, or platform routes them to incident response |