Which two items are appropriate content of custom logs implemented at checkout? Choose 2 answers:

Appropriate logging during a checkout process is critical for diagnostics and security. Logging order failure information (B) and payment gateway service response codes (D) provides essential data for developers and support teams to troubleshoot issues without exposing sensitive information. These logs help identify problems like system errors, inventory issues, or payment processing failures. Conversely, logging sensitive data like passwords or full credit card numbers is a severe security vulnerability and a violation of compliance standards such as the Payment Card Industry Data Security Standard (PCI DSS).

1. PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard (PCI DSS) v4.0. Page 49

Requirement 3.2. The standard explicitly states

"Do not store sensitive authentication data after authorization (even if encrypted)." This includes data like the CVV. Logging this information would constitute prohibited storage.

2. OWASP Foundation. (n.d.). OWASP Logging Cheat Sheet. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/LoggingCheatSheet.html. In the section "Data not to be logged

" the guide explicitly lists "Application user passwords" and "Payment card information." Conversely

the "What to Log" section recommends logging events like "Outgoing requests to other systems

" which includes payment gateway responses.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387-402. (Cited in numerous university security courses

e.g.

MIT 6.858). This foundational paper outlines the principle of least privilege. Logging sensitive data like passwords and credit card numbers violates this principle by granting the log files access to information they do not need

unnecessarily increasing risk.