1

What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the log entry? Do I miss anything here?

We are talking about a server application that should be logging financial data that can not be tampered, so that everything relevant can be reconstructed.

  • Can you provide some context to your question? – HashHazard Jul 19 '16 at 14:17
  • 1
    You normally send it over the network to the receiver and not database directly. There's plenty of new big data sinks and big data stores today available for free. They do accept syslog connections for example but the HTTPS/json is usually better. There are some more specialized solutions also. Every software today support network logging, even some very old ones. Except maybe web servers like httpd, haven't tried syslog with it myself. You might try MongoDB with latest storage engine which compresses data, it's good start. – Aria Jul 19 '16 at 14:33
  • And if you mean the mobile device, then it's different thing. You'd need to use embedded security, like hardware stored keys which can be only accessed with user-provided password. – Aria Jul 19 '16 at 14:51
  • It is on a different computer than the one sending the logs – Neil McGuigan Jul 19 '16 at 18:41
1

In order to have a secure audit log, think of integrity and availability, two characteristics of security per the security CIA triad.

  1. Integrity of audit log

All data written to the log, once written should be Read Only.. The data should NOT be able to be modified by any user if the log is to be trusted for forensic purposes. Access to the audit logs should be strictly controlled on a need to know basis, per security rule of Least Privilege. Ideally, the audit log is stored in a secure location such as a dedicated logging server. Write access needs to be restricted to only the minimum number of users, such as only users in a certain Active Directory group. Read access should be restricted in a similar fashion. To detect changes in a log, a cryptographic hash function can be applied to previous log entries, so that any tampering will alter the hash and render impossible tampering not to be detected.

  1. Availability of audit log

Audit log data should be retained for a specified period of time depending on the data sensitivity classification of the underlying source where logs are generated from. Backups of logs should ideally be stored offsite, so that if a disaster strikes, backups of such logs are not destroyed as well.

If logs are stored centrally on a logging server, tools such as client rate limiting, packet filtering can be used to mitigate DOS or DDOS attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.