Defensive › Module 5 › Lesson 2
Retention and Privacy
How long to keep logs and what not to hoard — on $LAB_HOST data only.
Visual · retention_privacy
Retention + privacy literacy. $LAB_HOST logs only. Original Cyberlium.
Opening
Retention is a policy number, not infinite hoarding — especially when logs touch people.
Retention defines how long logs live (30/90/365 days) based on risk, compliance, and disk. Privacy means minimizing sensitive fields, restricting access, and never collecting data you are not authorized to hold. Defenders align retention with legal and policy requirements on systems they operate. Cyberlium teaches writing a retention line for $LAB_HOST lab logs — not archiving classmate keystrokes or café patron metadata. Next: Alert Hygiene.
1. Retention tiers
Hot storage for recent investigations; warm/cold for compliance; delete when policy expires. Lab might use 30-day rotation on $LAB_HOST with logrotate literacy.
Exporting employer logs to personal Dropbox without authorization violates privacy and policy — stop.
Command guide
Try these commands — Retention tiers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-92 — https://csrc.nist.gov/publications/detail/sp/800-92/final Elastic logging — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
journalctl --disk-usage 2>/dev/null || du -sh /var/log 2>/dev/null | head -3
journalctl -n 100 --no-pager 2>/dev/null | python3 -c "import sys; lines=sys.stdin.readlines(); print('lines',len(lines)); print('sample',lines[-1][:120] if lines else 'none')"Primary tools to practice this lesson: journalctl, python3. Reference sites: NIST SP 800-92 (https://csrc.nist.gov/publications/detail/sp/800-92/final); Elastic logging (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Privacy minimization
Avoid logging passwords, full payment cards, or unrelated user content. Redact or hash identifiers where possible. chmod 600 on local log notes.
SIEM on stranger data you scraped is not defense — it is surveillance misuse.
3. Access control on log stores
Only operators in RoE read lab logs. Share aggregated metrics in class, not raw auth lines with usernames from real systems.
Ship: retention days + privacy line for $LAB_HOST logs. Next: Alert Hygiene.
4. What you ship: retention and privacy policy for lab logs
Retention days for $LAB_HOST logs. Fields you will NOT log. Access restricted. chmod 600.
5. What you record before the next lesson
Date. Retention and privacy lines. File t16-m05-l02-retention-privacy.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keep classmate SSH logs forever 'just in case.' Publish raw auth logs in Discord.
Right
Write retention and privacy lines for $LAB_HOST. Next: Alert Hygiene.
Mission: retention and privacy lines
1) Set a retention day count for lab logs on $LAB_HOST. 2) List two fields you will not log (passwords, etc.). 3) Note who may read logs (you only). Never hoard stranger data.
Stuck? Ask Cyberlium AI Mentor
GDPR and similar regimes care about purpose limitation — lab notes should too.
Knowledge Check
APPLY: Log retention should:
Multiple choice
Knowledge Check
APPLY: True or False: Logging cleartext passwords is acceptable for debugging.
True or False
Knowledge Check
APPLY: Sharing raw auth logs publicly:
Multiple choice