What is Insufficient Logging (CWE-778)?

TL;DR: Insufficient Logging (CWE-778) is a security vulnerability where critical events are not recorded or insufficiently detailed, hindering forensic analysis and making attacks harder to trace. Fix by implementing centralized logging with detailed event recording.

What is Insufficient Logging?

Insufficient Logging (CWE-778) is a type of security vulnerability that occurs when critical events are not recorded or important details about these events are omitted. As defined by the MITRE Corporation under CWE-778, and classified by the OWASP Foundation under A09:2025 - Security Logging and Alerting Failures.

Quick Summary

Insufficient logging is dangerous because it hinders forensic analysis and makes attacks harder to trace. This can lead to undetected breaches, financial losses, compliance violations, and reputational damage. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Insufficient Logging Overview · How Insufficient Logging Works · Business Impact of Insufficient Logging · Insufficient Logging Attack Scenario · How to Detect Insufficient Logging · How to Fix Insufficient Logging · Framework-Specific Fixes for Insufficient Logging · How to Ask AI to Check Your Code for Insufficient Logging · Insufficient Logging Best Practices Checklist · Insufficient Logging FAQ · Vulnerabilities Related to Insufficient Logging · References · Scan Your Own Site

Insufficient Logging Overview

What

Insufficient logging occurs when security-critical events are not recorded or important details about these events are omitted.

Why it matters

It hinders forensic analysis and makes attacks harder to trace, leading to potential undetected breaches and financial losses.

Where it occurs

In web applications that do not log critical security events such as failed login attempts, unauthorized access attempts, and other security-relevant activities.

Who is affected

Developers and organizations relying on insufficient logging mechanisms for security monitoring and incident response.

Who is NOT affected

Systems already using centralized logging with detailed event recording.

How Insufficient Logging Works

Root Cause

The root cause of insufficient logging lies in the lack of proper logging mechanisms that record critical events and provide sufficient detail to trace attacks or diagnose issues.

Attack Flow

1. An attacker performs a security-relevant action (e.g., unauthorized access attempt).
2. The application does not log this event properly, omitting important details such as user ID, IP address, timestamp, etc.
3. Forensic analysis is hindered due to missing logs or insufficient detail.
4. The attack goes undetected and remains unresolved.

   Prerequisites to Exploit

   • Security-critical events are not being logged.
   • Important details about security-relevant activities are omitted from the logs.

     Vulnerable Code

     def handle_login_attempt(user_id, ip_address):
      # No logging of failed login attempts
      if authenticate_user(user_id) == False:
        return "Login Failed"
     

     This code does not log any information about failed login attempts.

Secure Code

import logging

logger = logging.getLogger(__name__)

def handle_login_attempt(user_id, ip_address):
    # Log failed login attempts with user ID and IP address
    if authenticate_user(user_id) == False:
        logger.error(f"Failed login attempt for {user_id} from {ip_address}")
        return "Login Failed"

This code logs detailed information about failed login attempts.

Business Impact of Insufficient Logging

Confidentiality

• Attackers can exploit undetected breaches, leading to unauthorized access and data theft.
• Financial losses due to undetected security incidents.

  Integrity

• Unauthorized modifications may go unnoticed without proper logging.
• Compliance violations if logs are insufficient for regulatory requirements.

  Availability

• Attacks may disrupt services without leaving a trace in the logs.

Insufficient Logging Attack Scenario

1. An attacker performs unauthorized access attempts on an application’s login page.
2. The application does not log these failed login attempts properly, omitting important details such as user ID and IP address.
3. Forensic analysis is hindered due to missing or insufficiently detailed logs.
4. The attack goes undetected, leading to potential data theft and financial losses.

How to Detect Insufficient Logging

Manual Testing

• Review log files for security-relevant events.
• Ensure all critical activities are logged with sufficient detail.
• Check if failed login attempts, unauthorized access attempts, etc., are properly recorded.

  Automated Scanners (SAST / DAST)

  Static analysis can detect missing logging statements in code. Dynamic testing is required to verify that logs contain the necessary details during runtime.

  PenScan Detection

  PenScan’s scanner engines such as ZAP and Wapiti can help identify insufficient logging by reviewing log files and checking for security-relevant events.

  False Positive Guidance

  A true positive will have missing or insufficiently detailed logs, while a false positive may occur if the code has proper logging but is not being tested in an environment where attacks are simulated.

How to Fix Insufficient Logging

• Use centralized logging mechanisms that support multiple levels of detail.
• Ensure all security-related successes and failures can be logged.
• Set the level of logging appropriately in production environments.
• Enable detailed logging for cloud services like AWS S3 buckets, Azure blobs, etc., using provider-specific controls.

Framework-Specific Fixes for Insufficient Logging

Python/Django

import logging

logger = logging.getLogger(__name__)

def handle_login_attempt(user_id, ip_address):
    if authenticate_user(user_id) == False:
        logger.error(f"Failed login attempt for {user_id} from {ip_address}")

How to Ask AI to Check Your Code for Insufficient Logging

Review the following Python code block for potential CWE-778 Insufficient Logging vulnerabilities and rewrite it using proper logging mechanisms: [paste code here]

Insufficient Logging Best Practices Checklist

✅ Use a centralized logging mechanism that supports multiple levels of detail. ✅ Ensure all security-related successes and failures are logged properly. ✅ Set the level of logging appropriately in production environments to avoid excessive data collection costs. ✅ Enable detailed logging for cloud services like AWS S3 buckets, Azure blobs, etc., using provider-specific controls.

Insufficient Logging FAQ

How does insufficient logging occur?

Insufficient logging occurs when a security-critical event is not recorded or important details are omitted, making it difficult to trace and respond to security incidents.

Why is insufficient logging dangerous for web applications?

It hinders forensic analysis by leaving no trail of evidence for detecting attacks and diagnosing issues, thereby increasing the risk of undetected breaches.

How can I detect insufficient logging in my application?

Use manual testing techniques such as reviewing logs and checking if security-relevant events are recorded properly. Automated scanners like PenScan can also help identify missing or inadequate logging.

What is a real-world example of insufficient logging?

A web server that does not log failed login attempts, making it hard to track potential brute-force attacks.

How do I prevent insufficient logging in my application?

Implement centralized logging with detailed event recording and ensure all security-related activities are logged appropriately.

What is the impact of insufficient logging on business operations?

It can lead to financial losses, compliance violations, and reputational damage due to undetected breaches or attacks.

How does AWS S3 support detailed logging for security events?

Enable storage logging in Azure’s Portal under Monitoring (CLASSIC) > Diagnostic settings (classic), ensuring all relevant properties are properly set.

Vulnerabilities Related to Insufficient Logging

| CWE | Name | Relationship | |—|—|—| | CWE-223 | Omission of Security-relevant Information | ChildOf |

References

• MITRE
• OWASP A09:2025 - Security Logging and Alerting Failures
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Insufficient Logging and other risks before an attacker does.