Tamper Detection in Audit Logs

Tamper Detection in Audit LogsRichard T. Snodgrass, Shilong Stanley Yao and Christian CollbergUniversity of ArizonaDepartment of Computer ScienceTucson, AZ 85721-0077USAfrts,yao,collbergg@cs.arizona.eduAbstract actions can be later checked. As a simple example,every deposit to and withdrawal from a bank accountAudit logs are considered good practice for generates a separate audit record, so that the currentbusiness systems, and are required by federal balance in the account can be checked. As one test, theregulations for secure systems, drug approval sum of all deposits minus the sum of all withdrawalsdata, medical information disclosure, nancial should equal the change in total accounts over thatrecords, and electronic voting. Given the cen- period. If this auditing check fails the bank looks intotral role of audit logs, it is critical that they the discrepancy further.are correct and inalterable. It is not su - A variety of federal laws (e.g., Code of Federalcient to say, \our data is correct, because we Regulations for the Food and Drug Administration,store all interactions in a separate audit log." Sarbanes-Oxley Act, Health Insurance Portability andThe integrity of the audit log itself must also Accountability Act, Canada’s PIPEDA) and stan-be guaranteed. This paper proposes mecha- dards (e.g., Orange Book for security) mandate auditnisms within a database management system logs. The correctness of the auditing records them-(DBMS), based on ...