What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the log entry? Do I miss anything here?
We are talking about a server application that should be logging financial data that can not be tampered, so that everything relevant can be reconstructed.
In order to have a secure audit log, think of integrity and availability, two characteristics of security per the security CIA triad.
All data written to the log, once written should be Read Only.. The data should NOT be able to be modified by any user if the log is to be trusted for forensic purposes. Access to the audit logs should be strictly controlled on a need to know basis, per security rule of Least Privilege. Ideally, the audit log is stored in a secure location such as a dedicated logging server. Write access needs to be restricted to only the minimum number of users, such as only users in a certain Active Directory group. Read access should be restricted in a similar fashion. To detect changes in a log, a cryptographic hash function can be applied to previous log entries, so that any tampering will alter the hash and render impossible tampering not to be detected.
Audit log data should be retained for a specified period of time depending on the data sensitivity classification of the underlying source where logs are generated from. Backups of logs should ideally be stored offsite, so that if a disaster strikes, backups of such logs are not destroyed as well.
If logs are stored centrally on a logging server, tools such as client rate limiting, packet filtering can be used to mitigate DOS or DDOS attacks.
