Computer Security Art and Science, 2nd Edition

Chapter 25

Auditing

LADY MACBETH: Your servants ever Have theirs, themselves and what is theirs, in compt, To make their audit at your highness’ pleasure, Still to return your own.

— The Tragedy of Macbeth, I, vi, 27–30.

Auditing is a technique for determining security violations. This chapter presents the notions of logging (recording of system events and actions) and auditing (analysis of these records). Auditing plays a major role in detecting security violations and in postmortem analysis to determine precisely what happened and how. This makes an effective auditing subsystem a key security component of any system.

25.1 Definition

The development of techniques for auditing computer systems sprang from the need to trace access to sensitive ...