Using logs for forensics after a data breach

08.11.2010

There are actually two types of integrity you need to prove.

* Integrity of each raw log. This will prove no log has been tampered with or manipulated

.*Integrity of the log sequence.  This will prove no log has been added and no log has been deleted.

This is not easy to do.  For example, signing each log will guarantee log integrity but not the integrity of the log sequence. 

At this point you can rule out most homegrown log management solutions, and you can throw away most open source solutions; in fact, there are not many solutions that are capable of providing both of these.