“I got an email from an employee within RIM, who, after my review came out said ‘you were right,’” recalls Pogue, who pa

Revealing threats and vulnerabilities with the help of application runtime and log messages is an art that every enterprise software developer must learn. In general, security breaches and catastrophic failures in applications do not happen suddenly. Most of the time, there are some clues that no one notices in the first place. Therefore we must always log suspicious human activities (e.g., failed authentication and verification attempts with all low-level information like networks used, request origins, and user roles and privileges attached) as well as the system behaviours (e.g., increasing of spikes in resource consumption patterns, high loads on web servers, services getting choked randomly). When a suspicious event is noticed, make sure the logs capture all information related to it, ideally a full-stack trace including parameter values and additional information available from the application context.

Almost all the privacy laws (e.g., GDPR, CCPA) clearly advise developers to keep PII away from the logs. PII includes information like first name, last name, username, gender, birthday, mailing and billing addresses, emails, phone numbers, social security numbers (SSN), and credit card numbers.

By law, all financial data must be fully hidden/masked in the logs. Exposing such information in logs can easily result in serious lawsuits (can be even interpreted as criminal offences). Therefore, avoid such cases at all times.

System events must capture information on behaviour events (startups, stops, restarts, security events), changeover modes (cold, warm, hot), inter-service communication (handshakes, connection building statuses — connect, disconnect, reconnect, retry events), service instance IDs, actively serving APIs, actively listening IP and port ranges, configurations loaded (initial load up and dynamic updates), overall service health, and anything that helps to understand the behaviour of the system.

Note: Specifying what information to hide from logs will be easy if you can attach an attribute to each field specifying its visibility level (e.g., show, mask, hide, encrypt). If you have such a mechanism, you can enable and disable the visibility of fields just by updating a property in configurations. If you have a requirement for logging some of the user data in non-production environments, especially for testing and debugging purposes, this is the way to go. Alternatively, you can write parsers to filter the log messages and handle the sensitive fields according to the pre-defined instructions based on the environment.

Make sure you avoid logging information like business names, related personnel (employees, clients, suppliers, etc.), and business and personal contact information. Logs should never expose the business relationships and related party transactions to outsiders. To trace back specific transactions, instead of using real business names and identifiers, make sure you use an event ID generated by the system and pass it through the other services.

Security credentials and auth tokens are considered sensitive information, and making them exposed via logs help intruders carry out easy security breaches in the system. Therefore, always be mindful of such sensitive information and keep it away from the logs.

Apple’s creation was not inevitably a BlackBerry killer. Google, developing Android, scrapped QWERTY plans and went all-in on touchscreen. Tentative, iterating BlackBerry, didn’t. BlackBerries used minimal data and ran for days; the company didn’t think the iPhone, a data hog that wouldn’t make it 24 hours, had a big market. They also thought the even more conservative carriers would balk at the iPhone’s network load and Apple’s freeloading App Store. They had reason for concern — iPhones nearly broke AT