Audit Logger

Security audit logging is the systematic recording of security-relevant events and activities across an organization's information systems. Unlike application logging that focuses on functionality and debugging, audit logs specifically capture who did what, when, where, and with what result. This creates an immutable record of security events that is crucial for compliance, incident investigation, and forensics.

Compliance Requirements: Regulatory frameworks like HIPAA, PCI-DSS, SOC 2, and GDPR explicitly mandate audit logging. HIPAA requires logging all access to electronic protected health information. PCI-DSS requires detailed logging of all access to cardholder data networks. SOC 2 Type II requires demonstrating effective access controls through audit trails. Organizations without comprehensive audit logs cannot comply with these standards and face significant fines.

Beyond compliance, audit logs are your primary tool for incident investigation. When a security breach occurs, your first step is reviewing logs to understand what access was granted, what data was read or modified, and when the unauthorized activity occurred. Without audit logs, you're essentially working blind during forensic investigation. Additionally, audit logs serve as deterrents—users behave differently when they know their actions are being recorded and reviewed.

Comprehensive audit logging captures multiple categories of security-relevant events. Authentication Events: All login attempts (successful and failed), password changes, password resets, MFA setup modifications, and access token generation. Track source IP, timestamp, authentication method, and whether it succeeded or failed.

Authorization Events: All access grants and revocations—when users are added to groups, permission changes, role modifications, and privilege escalations. Log who made the change, what changed, and when. This is critical for detecting unauthorized access grants and insider threats.

Data Access Events: Access to sensitive data requires logging—particularly reading, modifying, or deleting sensitive information. For databases, log query execution with user context. For file systems, log file access particularly for sensitive directories. For APIs, log sensitive endpoint calls. Be aware this generates high volume; implement sampling or thresholds for high-access resources.

System Configuration Changes: Modifications to security settings—firewall rules, security group changes, encryption key modifications, audit log configuration changes. These changes themselves must be logged to detect tampering. Include changes to access control lists, network routing, and security policies.

Additional Events: Administrator actions (typically logged more comprehensively than regular user actions), security tool configuration changes, encryption key operations, and security incident responses. For sensitive systems, also log system startup/shutdown, backup operations, and privilege escalation attempts.

Audit logs must be protected from tampering or deletion, as they are your primary evidence in security investigations and compliance audits. Immutability Protection: Logs should be written once and never modified. Implement write-once, read-many (WORM) storage systems that prevent even administrators from deleting logs. Use append-only file systems and databases. Consider cryptographic techniques like hash chains or blockchain-style verification where each log entry contains a hash of the previous entry, making tampering immediately detectable.

Retention Policies: Different regulatory frameworks require different retention periods. HIPAA typically requires 6+ years, PCI-DSS 1 year, SOC 2 depends on specific controls but often 1+ years. Establish clear retention policies based on your compliance obligations, then enforce them technically. After the retention period, securely destroy logs—simply deleting files isn't sufficient; use cryptographic erasure or physical destruction.

Storage Architecture: Store audit logs in a separate system from the systems they monitor. If an attacker compromises your main system, they shouldn't be able to access audit logs. Use dedicated audit log storage infrastructure, potentially in a separate network segment. Consider centralized log aggregation systems (ELK, Splunk, CloudWatch) that collect logs from multiple sources into a single, protected repository.

Integrity Verification: Implement checksums or digital signatures on log files and regularly verify their integrity. Many compliance frameworks specifically require demonstrating that logs haven't been modified. Use HMAC-SHA256 or similar cryptographic techniques to create integrity proofs that allow you to prove logs haven't been tampered with.

Audit logs are only valuable if actively monitored and analyzed. The sheer volume of logs—production systems can generate hundreds of thousands of audit events daily—makes manual review impossible. Organizations must implement automated analysis strategies.

Real-Time Alerting: Define high-priority events that warrant immediate alerts: multiple failed authentication attempts, privilege escalation, changes to security configurations, and sensitive data access anomalies. Configure your logging system to alert security teams within minutes of these events occurring. Examples include 10+ failed logins in 5 minutes, password changes for privileged accounts, or bulk data downloads.

Behavioral Baselining: Establish normal patterns for system events, then alert on deviations. Normal authentication patterns, API usage volumes, data access frequencies, and configuration changes vary by role. Use machine learning to model these baselines and alert when activity deviates significantly. This catches subtle insider threats that pure threshold-based rules would miss.

Forensic Analysis: When incidents occur, audit logs enable detailed investigation. Develop capability to quickly correlate events across systems—trace a suspicious login through authentication logs, then track all actions performed by that session through application and data access logs. Implement log querying and correlation tools that allow security analysts to trace the full timeline of an incident.

Regular Review and Audits: Beyond automated alerting, implement regular manual review of audit logs. Weekly or monthly reviews can identify suspicious patterns that automated systems missed. Additionally, management should periodically review privileged user activity to detect insider threats. Document all reviews and findings for compliance purposes.

Cloud environments introduce unique audit logging challenges because you lose direct control over underlying infrastructure while still bearing responsibility for monitoring it. Multi-Layer Logging: Implement logging at application level (what your code does), cloud platform level (what the cloud provider logs), and network level (traffic and access patterns). Application logs capture business logic and sensitive operations. Cloud platform logs capture infrastructure events and API calls. Network logs capture traffic patterns and anomalies.

Cloud-Specific Services: Major cloud providers offer audit logging services: AWS CloudTrail, Azure Activity Logs, Google Cloud Audit Logs. Enable these to capture all API calls to cloud infrastructure. These services automatically store logs in cloud-managed storage, provide immutability guarantees, and integrate with security analysis tools. Ensure these logs flow to your central logging infrastructure alongside application logs.

Cross-Account and Cross-Region Monitoring: Many organizations use multiple AWS accounts or cloud regions for security and operational reasons. Audit logging must span all accounts and regions. Implement centralized log aggregation to a single account or region, but ensure data residency requirements are met. This prevents attackers from compartmentalizing their activities—if they compromise one region, central logs still capture their activity.

Protecting Against Insider Threats: Cloud administrators and developers have significant access. Implement MFA for all administrative access, use temporary credentials instead of long-lived access keys, enable CloudTrail logging on CloudTrail itself (detecting tampering), and restrict permissions on logging infrastructure. Consider having cloud logs stored in an immutable external system to prevent even cloud administrators from deleting evidence.