Locking the Log Book: MTSA's Data Security Requirement
Summary: This Dragos post walks through MTSA requirement 101.650(c), which requires that logs be securely captured, stored, and protected so only privileged users can access them, and that effective encryption protect sensitive data confidentiality and IT/OT traffic integrity where technically feasible. It cites a breach in which a remote-access threat group's first move was to delete logs that existed only locally with no central copy, and notes Salt Typhoon spent years inside the core networks of AT&T, Verizon, T-Mobile, Lumen and at least half a dozen other major U.S. carriers, reaching lawful-intercept systems that were supposed to be tightly access-controlled.
What's compelling: Dragos says that across the vast majority of its incident response cases, the customer either doesn't have the logs or has never mapped what logging exists, and that discovery routinely eats more time than the investigation itself. In one breach the attacker deleted the only copy of the logs and nobody knew until the investigation found unexplained gaps.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026