Log Management, Turkish Law 5651 Compliance and Time Stamping

We first determine in what capacity the organisation is liable; requirements differ for hosting, access and mass-use providers.

• Determination and justification of the organisation’s legal capacity
• Inventory of in-scope systems, links and user groups
• Derivation of retention period and record content requirements
• Assessment of guest network, wireless and hotspot scenarios
• Gap analysis of the current state and a roadmap

The evidential value of a record depends on an accurate, provable time source. The collection layer is designed so that nothing is lost.

• Collection of firewall, proxy, NAC and DHCP records
• NTP infrastructure synchronised to a national time source
• Clock drift monitoring with alerting
• Detection of missing records and monitoring of collection continuity
• Resolution of user-to-IP mapping, including behind NAT
• Normalisation of record formats and field mapping

A record becomes evidence only if it can be shown not to have been altered, which puts hashing and qualified time stamping at the centre of the chain.

• Hashing and signing of log files
• Integration with a qualified electronic time stamp service
• Time stamp verification and periodic re-stamping
• Immutable (WORM) storage
• Access logging and four-eyes authorisation
• Automatic generation of integrity verification reports

Records are retained for the period the law requires and then destroyed under record. Indefinite retention is itself a risk.

• Tiered hot, warm and cold storage architecture
• Capacity planning and growth forecasting
• Backup, secondary copy and disaster scenarios
• Recorded disposal of expired data
• Joint management of KVKK and Law 5651 retention periods

When a request arrives, the record must be found within minutes and handed over in a verifiable form.

• Response workflow for judicial and regulatory requests
• Fast querying by user, IP, time range and destination
• Export together with a verification digest
• Report templates ready for audit
• Logging of the query operations themselves

The records collected for compliance are also used for detection and response, without a second investment.

• Consumption of the same log pool by the SIEM
• Security use cases derived from compliance records
• Detection of anomalous access and data egress
• Timeline construction during incident response
• Provision of evidence for forensic examination