Problem
• What sort of information should a workstation be logging?
• If logs are sent to a centralised system, an attacker who is able to compromise that system would have access to logs from every machine on your network. What sort of information could they potentially gain from that?
• What sort of information should you ensure you never log?