Audit logs immutable or tamper-evident

Audit logs stored in the same database as application data can be silently deleted or modified by a compromised admin account, eliminating the forensic record of the compromise itself. NIST 800-53 rev5 AU-9 (Protection of Audit Information) requires that log write access be restricted to the audit system only; AU-10 (Non-Repudiation) mandates a mechanism to prove log integrity. CMMC 2.0 AU.L2-3.3.2 extends this requirement to CUI systems. CWE-345 (Insufficient Verification of Data Authenticity) covers the specific failure of storing records without integrity protection. An attacker who can modify logs can rewrite or delete evidence of their own access.

Ship audit logs to a dedicated service outside the application database. For a self-managed option, implement a hash chain where each entry references its predecessor's digest.

// lib/tamper-evident-logger.ts
import crypto from 'crypto'
import { db } from './db'

export async function appendAuditLog(event: Record<string, unknown>) {
  const prev = await db.auditLog.findFirst({ orderBy: { id: 'desc' } })
  const prevHash = prev?.hash ?? '0'.repeat(64)
  const payload = JSON.stringify({ ...event, ts: Date.now() })
  const hash = crypto.createHash('sha256').update(prevHash + payload).digest('hex')
  await db.auditLog.create({ data: { payload, hash, prevHash } })
}

Prefer a managed, append-only log service — AWS CloudWatch Logs (with log group retention and no delete IAM actions granted to the app role), Datadog, or Azure Monitor all provide tamper-resistance without custom code. Restrict DELETE on audit_logs tables at the database level so the application service role cannot issue it.