3

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server.

I was wondering what is generally considered a best practice when it comes to log signing?

Improve this question
1
  • What might be useful is to outline your threat model. I have answered based on the most common scenario (in my experience)
    – Rory Alsop ♦
    Commented Jun 25, 2014 at 9:07

1 Answer 1

Reset to default
2

Digital signing is used in some situations - generally just with a timestamp included in the signature - but generally the technique used to protect against modification of logs is to use a device classed as Write Once, Read Many (WORM)

This can include CD/DVD media at the consumer level, up to large scale WORM installations at corporate level.

Notice this doesn't protect against falsified data being written to the log, but that specific risk is not usually on 'normal' threat models.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .