Log Retention Strategy for Ukrainian Government Security Operations

Security logs are the documentary record of everything that happens in an IT environment. When a cyber attack occurs—particularly one involving months of dwell time before a destructive payload is deployed—the ability to reconstruct the attacker's actions depends entirely on whether relevant log data was retained and remained uncompromised. Ukraine's experience with Russian attacks that exploit extended dwell time has made log retention policy a foundational security control rather than a compliance afterthought.

Minimum Retention Requirements

SSSCIP's 2023 log retention directive established a minimum mandatory retention period of six months for security-relevant logs across all Ukrainian government systems. For Tier-1 systems—national security, critical infrastructure, financial systems—the minimum is extended to 24 months, reflecting the documented reality that Russian intelligence operations may maintain access for a year or more before triggering destructive or espionage activity. These retention minimums apply regardless of how logs are stored, permitting cost-efficient cold storage for older data as long as logs remain accessible and unmodified.

The six-month minimum was derived from analysis of incident response cases where establishing the initial compromise timeline required log data older than the organization's prior 30-day retention window. In multiple incidents, the absence of older logs made it impossible to fully reconstruct attack entry points, hampering both the current incident response and the longer-term analysis needed to prevent recurrence. The extended 24-month requirement for Tier-1 systems directly addresses the long-dwell-time attack model that Russian threat actors have repeatedly employed.

Log Source Priority Classification

Not all log types carry equal forensic value. Ukraine's log retention framework classifies log sources into tiers determining both collection priority and retention duration. Authentication logs—covering logins, login failures, MFA events, and privilege escalations—are classified as Tier 1 log sources with the highest retention requirements and warm storage for rapid querying. Network flow data (NetFlow, sFlow) captures communication patterns useful for lateral movement detection and is retained in compressed format. High-volume, lower-forensic-value logs (routine DNS queries, successful file reads) may be subject to selective retention or extended aggregation before archival.

Log Retention Tiers for Ukrainian Government Systems

Compressed Log Storage Cost Management

Compliance with 24-month retention requirements for high-volume log sources at Tier-1 systems generates substantial storage costs. Ukraine's government addresses this through a combination of compression, tiered cloud storage, and intelligent pre-processing. Security-relevant logs are compressed before archival to cold storage using high-ratio compression algorithms (achieving 10:1 to 20:1 compression for text-based logs). Prior to cold storage, logs are deduplicated to remove repeated identical events that add retention volume without forensic value. The combination typically reduces 24-month storage costs by 60–75% compared to uncompressed warm storage retention.

Legal Requirements and Immutability

Ukraine's cybersecurity legislation and criminal procedure code create legal obligations for log retention in contexts where logs may be required as evidence in criminal proceedings. Cyber attacks constitute criminal offenses under Ukrainian law; prosecuting perpetrators requires forensic evidence in the form of logs meeting chain-of-custody requirements. SSSCIP guidance specifies that logs intended for potential use in criminal proceedings must be stored in immutable, hash-verified form with documented chain of custody from the point of collection.

The immutability requirement creates a technical convergence with the ransomware defense immutable backup requirements discussed in other contexts: immutable log storage prevents attackers who may have accessed logging infrastructure from destroying or modifying evidence of their activities—exactly what several Russian threat actors have attempted during destructive campaigns targeting Ukrainian organizations.

FAQ

Why do Ukrainian Tier-1 systems require 24-month log retention?

Russian intelligence operations documented against Ukraine have involved dwell times of 6–18 months between initial access and disruptive action. Investigating these incidents requires log data older than standard 30–90 day retention windows. The 24-month requirement ensures that retrospective investigation can cover the full likely dwell time of sophisticated attacks.

What is the difference between warm and cold log storage?

Warm storage keeps logs in a query-ready format with fast retrieval times, at higher cost. Cold storage uses archival formats with lower cost but slower retrieval—data may need to be decompressed or restored before being queried. Time-sensitive incident response uses warm storage; historical investigations into older data use cold storage.

How does log compression reduce storage costs?

Security logs are typically text-based with highly repetitive content—timestamps, source IPs, event codes appearing millions of times. Standard compression algorithms exploit this repetition to achieve 10:1 to 20:1 compression ratios, reducing storage consumption and therefore cost proportionally.

What legal chain of custody requirements apply to logs?

For logs to be admissible as criminal evidence, they must be collected in an unaltered state, stored immutably with documented custody from collection through presentation, and have their integrity verifiable through cryptographic hash values computed at collection time and verified throughout storage.

Are there log types that Ukraine does not require to be retained at all?

Yes—debug logs for non-critical applications, routine informational messages with no security relevance, and high-volume data without forensic value may be subject to much shorter retention or not retained at all. The framework focuses retention investment on log sources with forensic value proportional to the threat model.

Sources

1. SSSCIP Ukraine — "Log Retention and Security Monitoring Requirements Directive," 2023
2. CISA — "Logging Made Easy: Guidance for Log Source Prioritization," 2022
3. Microsoft — "Log Analytics Workspace Retention Configuration for Ukrainian Government," technical guide 2024
4. NIST — "Guide to Computer Security Log Management, SP 800-92 Rev 1," 2023
5. CERT-UA — "Forensic Evidence Requirements for Cyber Incident Criminal Proceedings," guidance note 2024