Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's first look at the book Microsoft Windows Security Essentials:

... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable accountability within an organization.

I'm a bit confused here, since it seems accountability is different than accounting, and it also includes authentication and authorization! OK, let's go on.

Some other references take auditing to be equivalent to accounting, while others consider auditing as a means of accounting.

Finally, what is the difference between "security logs" and "security audit trail"?

Please, if you can, provide me with a reliable reference, which defines the terms.

share|improve this question
1 A fairly authoritative reference. – Stephen Bachelor Jun 19 '13 at 17:13
@StephenBachelor: Thanks. It defines most of the terms I need. There's a caveat, however: the definitions are inclined more towards business and finance than security. For instance, "accounting" is used in terms like "cost accounting" or "yearly accounting period". – M.S. Dousti Jun 19 '13 at 17:33
A security log would be an individual authenticated recording of activity. The log from MYBOX might contain "John signed on to MYBOX at 17:04. John used RDP to remotely connect to PAYROLLBOX at 17:05. John ended RDP at 17:07. John signed out at 17:08." But it doesn't log what John did while connected to PAYROLLBOX. That log is the responsibility of PAYROLLBOX. A security audit trail would be the collection of all such logs from all affected boxes, tracking John's activities from start to finish. – John Deters Jun 19 '13 at 22:10
up vote 5 down vote accepted

I'll try put these terms in their respective context, which will make them a lot easier to understand.

When a user wants to use your system, you authenticate them by making sure they're who they are, using passwords; certificates; cards; PINs; etc. Then check if they have the correct authorization, that is, you check if they have the permissions required to access certain resources or aspects of your system.

When a user accesses a resource, you log that operation along with all important metadata. Your logging operation makes sure that every action is accounted for. You log which user has performed the action or access the resources, using which machine, using an access level given by whom, and all other identifying information.

Later, when an independent entity (external or internal) audits the system by making sure all the records and logs don't contain any abnormalities and all the systems are compliant, it's possible to identify (with accuracy and certainty) which entity hash performed a certain action or accessed a certain resource.

A system that provides all of that in normal situations and in incident-response cases is system that has accountability.

share|improve this answer
but I think it is not possible to make system that is sure 100% which users did which actions. right? – John The Ripper Jun 19 '13 at 20:11
@JohnTheRipper I believe you're correct. It's very difficult (if not impossible) to create a system that provides complete accountability. But many systems (systems that uses biometrics, for example) could provide very high degree of accountability. – Adi Jun 19 '13 at 20:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.