Cybersecurity Security Logging

How it works

A security event should help answer who did what, to which resource, when and with what outcome. Use a stable structure and a correlation identifier, while minimising personal and secret data. Log readers need restricted access and retention suited to the service. Logs can themselves become an injection or disclosure channel if arbitrary text is printed without structure.

Run the code

Save the complete source as security-logging.py in a separate learning folder, then run python security-logging.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

import json
event = {"time": "2026-06-12T09:10:00Z", "actor": "borrower-18", "action": "loan.return", "resource": "loan-42", "outcome": "denied", "request_id": "demo-07"}
encoded = json.dumps(event, sort_keys=True)
assert json.loads(encoded)["outcome"] == "denied"
assert not ({"password", "session", "token"} & event.keys())
print("structured denial event recorded without credential fields")

Expected result

structured denial event recorded without credential fields

The timestamp and identifiers are fictional fixed fixtures. Structured JSON preserves field boundaries and makes later filtering predictable. The absence of three field names is not a universal leak detector: design the logging interface to accept only approved values and check real output, including errors.