Monday, November 23, 2009

Protecting the Audit trail

I was on a phone call with a potential client, and they were indicating that one of their concerns was how to protect an audit trail from being altered.

Many auditing products store their audit trial in a commercial or external database, like SQL Server or Oracle. While handling gobs of uniform data is exactly what a database is very good at, it isn’t good for audit trails. Audit trails need to be written ‘forward only’ and not be alterable.

Commercial and external databases are powerful tools and provide ways for the data to be entered, sorted, displayed, deleted, altered, etc. Commercial databases also have database administrators (DBAs) and system administrators, which have complete access over all aspects of the database, including any audit log stored in them.

When we designed FileSure, we considered these issues along with the cost and maintenance requirements of using a commercial database before deciding to go with a file based engine. By using a file based engine, we were able to encrypt and compress the audit log, thereby protecting it from altering or even viewing from any source other than FileSure itself.

1 comment:

Arthur said...

I agree, the right solution for data protection, I also know this method. In addition to data encryption, it was important to find an electronic form application that would facilitate audit and automate the collection of customer data form.com/form-software/offline-forms . It's easy to manage the system, and this is now applied not only to me but also for my colleagues in the firm. Because the form is adaptive and it simplifies the use on the IOS and Android.