Security Logging & Monitoring Failures: Log Injection (CRLF), PII masking, and SIEM Honeytokens.

Defensive Observability

Without adequate logging and monitoring, data breaches go undetected for an average of 200+ days. However, logging sensitive data carelessly introduces massive legal and security liabilities.

Attacker input in login username field:
alice\r\n[2026-11-09 10:00:00] [INFO] User admin successfully logged in!

Vulnerable Logger writes raw string:
[2026-11-09 09:59:59] [WARN] Failed login for user: alice
[2026-11-09 10:00:00] [INFO] User admin successfully logged in!
Result: CRLF Log Injection forges audit logs and confuses security analysts!

Defensive Logging Standards

1. Always use Structured JSON Logging: Libraries like Pino or Winston escape newlines automatically.
2. Mandatory PII Masking: Never write passwords, credit card numbers, or Social Security numbers to disk:

const piiMasker = (key: string, value: any) => {
  if (['password', 'token', 'cvv', 'secret'].includes(key.toLowerCase())) {
    return '***REDACTED***';
  }
  return value;
};

3. Honeytokens (Canary Credentials): Place fake AWS credentials or fake database tables into production. If an alert fires for those credentials, you have verified active unauthorized reconnaissance.