In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs?
Signing each log entry is a possibility, but that does no prevent a malicious operator from hiding some of the logs.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Also an excellent answer is given here Techniques for ensuring verifiability of event log files and https://crypto.stackexchange.com/questions/8104/tamper-proofing-log-files
Log to a dedicated machine which does nothing but this and has restricted access. A special-purpose machine requires a lot less administration than one that hosts a complex service, so few people would need to have access to the log server.
If you really need very high integrity assurance, log to a paper tape. That requires physical access to perform any tampering, and erasing paper logs tends to leave evidence (cut paper, ashes, …).
You might consider running your logging service inside a secure enclave like Intel SGX. Having a log signed by a hardware root-of-trust mitigates the risk of an attacker or insider tampering with the log.
My personal preference would go to Open TripWire, It's quite adept at monitoring the entire filesystem for local modifications.
Like you said, data destruction is always a risk, so maybe RSync the log folder to a remote host.
Set the correct permissions. For example, only the users from a certain group are allowed to write logs, while reading is available to another group. Store the logs at multiple locations so you can compare them later on. If logs become large, archive and encrypt them with asymmetric encryption and sign them.
You could also you an online service to outsource all these operations.
Include a hash of the previous log entry for each entry. Depending on security requirements, a hash of the log, can be sent to bitcoin network or a timekeeping service or similiar, to create a "timestamp" that will make it impossible to modify the log without being detected.
When you rotate, you just hash the whole log file and include that hash in the start of the next log file. At the time of log rotation, is also a great time to do the actual timestamping, for example by bitcoin network or a timekeeping service.
Yes, a advisary can delete or destroy the log, but that will leave telltale evidence of being done.