Why Your Audit Log Needs a Hash Chain
An honest engineering argument for tamper-evident audit logging — and the limits it cannot overcome. 1. The promise of an audit log Compliance frameworks (SOC 2, ISO 27001, PCI DSS) and security teams ask one question repeatedly: can you show what happened, and can you prove nobody changed the record afterwards? An audit log is supposed to answer both halves. In practice, most logs answer only…
An audit log records what actions occurred on a system, but a normal log is vulnerable to tampering. Most logs only prove what happened, not that the record hasn't been altered. The issue is particularly critical during incidents, audits, or disputes. Audit logs reside on the same machines as the systems they monitor, so anyone with destructive capabilities can easily alter the log.
To make rewriting detectable, hash chains are used. Each new record's hash is appended and links to the previous record's hash, creating a chain of hashes. Verification involves recalculating hashes and checking for anomalies. A hash chain can detect edit, deletion, insertion, reordering, and whole-log rewriting, but not tail truncation.
To address this, anchor the latest hash to an immutable source. Hash chains are lightweight and add security without requiring special hardware. However, they don't prevent tampering; they only detect it. For prevention, access control and key management are still necessary. The implementation of hash chains is provided in the auditchain library.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
