3

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server.

I was wondering what is generally considered a best practice when it comes to log signing?

  • What might be useful is to outline your threat model. I have answered based on the most common scenario (in my experience) – Rory Alsop Jun 25 '14 at 9:07
2

Digital signing is used in some situations - generally just with a timestamp included in the signature - but generally the technique used to protect against modification of logs is to use a device classed as Write Once, Read Many (WORM)

This can include CD/DVD media at the consumer level, up to large scale WORM installations at corporate level.

Notice this doesn't protect against falsified data being written to the log, but that specific risk is not usually on 'normal' threat models.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.