What is log tampering and how can you detect it?

• A. Deleting log files is the primary detection method for tampering
• B. Altering log entries to hide activity; detect with tamper-evident logging, file integrity monitoring, and centralized secure storage
• C. Logging should never be secured
• D. Using a single log file with no backups

Answer: (B)

Log tampering is when someone alters log records to hide evidence of wrongdoing, such as editing entries, deleting records, or shifting timestamps after the events occurred. To detect this, you want mechanisms that make changes visible and verifiable.

Tamper-evident logging protects the integrity of the log stream by designing logs to be append-only and by linking entries with cryptographic hashes or digital signatures. If any entry is altered, the chain breaks or signatures don’t match, triggering an alert. File integrity monitoring watches the actual log files and their metadata for unexpected changes like edits, truncations, or permission changes, so suspicious activity is detected promptly. Centralized secure storage keeps logs off the original systems in a protected location with strong access controls and often immutability (for example write-once or long-term protected storage) and reliable backups, making it much harder for an attacker to tamper with or delete evidence.

These combined approaches provide timely detection and durable evidence of tampering. Deleting log files, on the other hand, is the act of tampering itself rather than a detection method, and relying on a single log file with no backups is poor practice that increases the risk of losing evidence.