Secure Audit Logs to Support Computer Forensics¶
Schneier, B., & Kelsey, J. (1999). Secure Audit Logs to Support Computer Forensics. ACM Transactions on Information and System Security, 2(2), 159-176.
Cited by¶
3 citations across 3 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Credible Commitment
- Software and AI safety. Hard-coded refusals, append-only logs, and immutable audit trails are technical commitments — the system cannot misbehave even if instructed to, removing the question of whether it will.
This sourceEstablishes append-only, tamper-evident logging in which prior entries cannot be modified or destroyed undetectably — a technical commitment device that removes the question of whether a system will be altered after the fact.
Supported in partVerified against the work's full text
Shows tamper-evident logs whose earlier entries cannot be altered undetectably, but states these detect rather than prevent tampering and addresses no refusals or AI systems.
“no cryptographic method can be used to actually prevent the deletion of log entries”
- Software and AI safety. Hard-coded refusals, append-only logs, and immutable audit trails are technical commitments — the system cannot misbehave even if instructed to, removing the question of whether it will.
Mechanisms¶
- Criterion-Version and Decision Audit Log
- The log is essentially an append-only record: entries are only ever added, never edited in place, so the sequence of what was decided under which rule is preserved intact.
This sourceConstructs audit logs as sequential hash-chained entries so earlier entries cannot be altered or replaced without detection and their order remains verifiable.
- The log is essentially an append-only record: entries are only ever added, never edited in place, so the sequence of what was decided under which rule is preserved intact.
- Transition Audit Log
- - Append, never overwrite. Each transition is written as a new entry to an immutable sequence; entries are chained or hashed so any later tampering is detectable — the record's trustworthiness rests on its immutability.
This sourceUses evolving cryptographic authentication to make prior log entries impossible to modify or destroy undetectably after compromise.
- - Append, never overwrite. Each transition is written as a new entry to an immutable sequence; entries are chained or hashed so any later tampering is detectable — the record's trustworthiness rests on its immutability.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 1 of 3 citations: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:89db7afb7600 · see in the full table