Principles of Secure Logging for Safekeeping Digital Evidence

摘要

The investigation of log files is an essential part of any form of IT incident management and IT forensics. In situations where logs can be manipulated, logging approaches that offer security guarantees are advisable. Within a formal system model, we describe several well-known existing approaches to secure logging and compare them with each other. Furthermore, we formalize the security requirements of secure logging approaches and systematically investigate which combinations of guarantees are achieved by the published approached under increasingly stronger attacker models.