The principle of integrity in information security ensures that data has not been altered in an unauthorized manner. A log that cannot be modified (i.e., is immutable or write-once) provides the highest level of assurance that its contents are original, accurate, and trustworthy. This is a fundamental preventive control for maintaining the evidentiary value of logs. While other options are good security practices, they do not directly guarantee that the log data itself has not been tampered with. Immutability is the most direct and effective control for assuring log integrity.

A. Reviewing logs is a detective control used to identify anomalies after they occur; it does not prevent the log from being altered beforehand.

B. Authorized access is a control primarily for confidentiality. An authorized user with modification privileges could still alter the log, compromising its integrity.

D. Retaining logs according to policy ensures their availability for future analysis and meets compliance requirements, but it does not protect the content from modification.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Task Statement 4.5. The manual emphasizes that for logs to be effective for forensic analysis

their integrity must be maintained. It discusses techniques such as writing logs to write-once

read-many (WORM) devices or a separate

secured log server to prevent modification.

2. National Institute of Standards and Technology (NIST) Special Publication 800-92

"Guide to Computer Security Log Management." Section 3.3

"Log Storage and Disposal

" states

"Protecting log information from unauthorized modification and destruction is critical for preserving its integrity." It recommends storing logs on a separate

dedicated log server with restricted access and using append-only mechanisms to prevent alteration of existing log data.

3. ISACA

IT Audit

Control

and Security

by Robert R. Moeller (2009). Chapter 16

"Auditing Firewalls

Extranets

and Other Network Security Systems." The text discusses the importance of firewall logs as an audit trail and highlights that their value is contingent on controls that prevent tampering

such as remote logging to a secure

write-protected server. This directly supports the concept that immutability is the key to integrity.