In the development of an organization's web system (containing sensitive information) with credentials, where the actions carried out must be monitored, what information should I keep when each action takes place?
For example, let's suppose the administrator accepts a transaction and months later he says "It wasn't me". We should have the correct pieces of information (apart from the login credentials used at the moment) to check if it was him or not, at least to support a legal act.
The minimum information I guess that should be considered:
- IP at the moment of the action.
- Exact date.
- The values before and after the transaction.
I understand that this depends a lot on the context, so in that case, let's answer for the example I wrote.