What should be done to audit trail files to prevent tampering?

What should be done to audit trail files to prevent tampering?

• A. Encrypt audit trail files
• B. Protect audit trail files from unauthorized modifications
• C. Store on local machine only
• D. Share publicly

Answer: (B)

Protecting audit trails from unauthorized changes is about preserving their integrity so you can trust that the logs reflect what actually happened. The best approach is to prevent any modification in the first place: implement strong access controls so only authorized individuals can touch the logs, and use an append-only or write-once storage design so entries can only be added, not altered or deleted. Centralize logs in a secure location and protect them with integrity checks such as cryptographic hashes or digital signatures, which make any tampering detectable. Using tamper-evident storage and maintaining accurate time synchronization further helps preserve the trustworthy sequence of events. Encrypting logs protects confidentiality but doesn’t guarantee integrity; someone with the right keys could still alter the logs, and there’s a risk if keys are compromised. Storing logs only on a local machine increases the chance of loss or tampering without defense in depth. Sharing logs publicly would expose sensitive information and undermine confidentiality and control.

Protecting audit trails from unauthorized changes is about preserving their integrity so you can trust that the logs reflect what actually happened. The best approach is to prevent any modification in the first place: implement strong access controls so only authorized individuals can touch the logs, and use an append-only or write-once storage design so entries can only be added, not altered or deleted. Centralize logs in a secure location and protect them with integrity checks such as cryptographic hashes or digital signatures, which make any tampering detectable. Using tamper-evident storage and maintaining accurate time synchronization further helps preserve the trustworthy sequence of events.

Encrypting logs protects confidentiality but doesn’t guarantee integrity; someone with the right keys could still alter the logs, and there’s a risk if keys are compromised. Storing logs only on a local machine increases the chance of loss or tampering without defense in depth. Sharing logs publicly would expose sensitive information and undermine confidentiality and control.