1

I am researching logging in a way that it could be used legally and also forensically trustworthy. I have seen discussions about remote logging, hash chaining, timestamp chaining, write-once media. My question is, Is it a viable solution to use an encrypted database, with similar techniques? If so, are there any points that make this more attractive an option security wise?

1
  • There is a cryptographic technique called a Merkle Tree. I don't know the details, but some info here. This is probably more of theoretical interest that something you want to implement in production.
    – paj28
    Commented Oct 26, 2016 at 19:48

1 Answer 1

1

Not that I can see. An encrypted database is (partially) protected against outside attackers. For your logs to be forensically acceptable, they need to be protected from modification by you and your system administrators who have full authorised access, and since you'll have the keys to your encrypted database, the encryption doesn't help with that.

7
  • For your logs to be forensically acceptable, they need to be protected from modification by you and your system administrators who have full authorised access - that rules out all log files since sysadmins have root access. Commented Oct 26, 2016 at 18:10
  • 1
    Not necessarily. You can buy forensically certified write-once media that your sysadmins can't overwrite, or you can immediately ship your logs off-site to a third party who doesn't let you modify them.
    – Mike Scott
    Commented Oct 26, 2016 at 18:12
  • Not familiar with the write-once option, however in this context root access could still manipulate logs before they're shipped off the system. Commented Oct 26, 2016 at 18:22
  • As an alternative to write-only media, it is sometimes also possible to assert that the data hasn't been tampered by periodically publishing the hash of your database (or the head of the hash chain) into a public and widely distributed system, like as blockchain message in Bitcoin or a physical newspaper.
    – Lie Ryan
    Commented Oct 26, 2016 at 18:23
  • @user2320464 Not if the write-once media is mounted as the log drive and the logs are written directly to it.
    – Mike Scott
    Commented Oct 26, 2016 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .