Security Logging and Audit Trails¶

Security events must be logged immutably to detect attacks, support incident response, and provide non-repudiation; what you don't log, you can't investigate.

Tension Addressed¶

Transparency vs. Confidentiality

Recognizable As¶

Authentication event logs; access logs; change logs; immutable log storage; log aggregation; alerting on anomalies; audit trails for compliance; security information and event management (SIEM).

Canonical Sources¶

NIST 800-92 (Guide to Computer Security Log Management)

Transfers To¶

Financial auditing (audit trails), legal compliance (record keeping), debugging (application logs), scientific research (experiment logs)

Sub-concepts: - Non-repudiation: Logs prove that actions occurred and who performed them; actors cannot deny their actions - What to log: Access attempts (success and failure), privilege changes, data modifications, security configuration changes - but never secrets themselves