In order to have a secure audit log, think of integrity and availability, two characteristics of security per the security CIA triad.
- Integrity of audit log
All data written to the log, once written should be Read Only.. The data should NOT be able to be modified by any user if the log is to be trusted for forensic purposes. Access to the audit logs should be strictly controlled on a need to know basis, per security rule of Least Privilege. Ideally, the audit log is stored in a secure location such as a dedicated logging server. Write access needs to be restricted to only the minimum number of users, such as only users in a certain Active Directory group. Read access should be restricted in a similar fashion. To detect changes in a log, a cryptographic hash function can be applied to previous log entries, so that any tampering will alter the hash and render impossible tampering not to be detected.
- Availability of audit log
Audit log data should be retained for a specified period of time depending on the data sensitivity classification of the underlying source where logs are generated from. Backups of logs should ideally be stored offsite, so that if a disaster strikes, backups of such logs are not destroyed as well.
If logs are stored centrally on a logging server, tools such as client rate limiting, packet filtering can be used to mitigate DOS or DDOS attacks.