Web Commerce Security Design and Development

System and Data Audit

The traditional means of enforcing accountability in software has been a combination of auditing and nonrepudiation measures. Auditing amounts to security-focused event logging to record all security-relevant actions performed by actors while interacting with the system. What distinguishes auditing from standard event logging is the type of information captured in the audit record and the level of integrity protection applied to the audit records to prevent them from being intentionally or inadvertently deleted, corrupted, or tampered with.

Additional factors that contribute to the accuracy, level of detail, and type of information that should be captured in the audit trail include compliance requirements (such as Sarbanes-Oxley) and law enforcement requirements (such as forensic investigation). The Sarbanes-Oxley Act was enacted in July of 2002 and regulates corporate financial practices, provides standards for external auditor independence, and defines corporate responsibility by senior executives.

The following design considerations and best practices for auditing in a Web application are summarized from the Open Web Application Security Project (OWASP)⁸:

• Ensure that the software records the correct time (timestamp) — for example, synchronizes with the atomic clock time source.
• Secure the communications channel with encryption — for example, SSL between the logging host and the destination.
• Use an HMAC or similar tamper-proofing mechanism to prevent changes ...