How can I securely store audit logs of activity from a system such as together with source data or separately off site?
As an IT auditor, let me give you an answer from experience.
Segregation of duties - SOD
It is a good practice and core principle to segregate employees who operate or administer the system from which audit logs are produced from employees such as myself, with responsibilities to review these logs for fraud / malicious activity / security vulnerabilities. If these duties are not segregated, then a single individual can undermine the system by making a malicious change, and cover his wrongdoing by modifying the audit logs to hide his actions. To illustrate, the following individuals in general should not have access to log data.
- Security administrators
- Computer operations personnel
- Data base administrators
To expand on the above examples, if a security administrator has access to logs data, he can escalate his own privileges to allow for improper access greater than is appropriate for his job duties, a violation of the security principle of Least Privilege. To prevent or deter detection, he can delete and / or falsify values for log entries of date, user ID...etc. The same reasoning applies to items 2 and 3.
To prevent the aforementioned, logs can be centrally stored in a server in which access is strictly controlled to individuals with specific roles - RBAC. Periodic review of individuals having access to logs should be conducted and improper access rights should be removed immediately upon discovery.
Secure storage of logs
Log data should be backed up on a regular basis and the backup should be stored offsite away from main company operations. This is to ensure that if a disaster (ex: Fire or flood) were to occur at the main company site, data loss will be mitigated.If logs contain sensitive information, log backups should be encrypted using strong cryptography such as AES 256. A written method, such as receipts should be used to track shipping and receipt of these logs. Periodically, a reconciliation of backup media should be taken against the tracking documentation, with any failed reconciliations promptly investigated.
Monitoring procedures regarding security and confidentiality of backup storage should be documented. If these responsibilities are delegated to a third party to perform, SLAs and a contract should ideally be in place, explicitly specifying the duties of each party (Company and vendor), and ideally include a right to audit clause in the contract. Log retention length of time should be documented in a retention policy known to all individuals with a job role of handling backups.
Finally, to learn more, this is an authoritative source from ISACA.