What makes a security record auditable?

Most security tools can export a log. An auditor reading it has to trust the tool, the person who exported it and everyone who handled the file. An auditable record reduces how much of that trust is needed.

Four questions separate the two.

Has it changed?

A cryptographic hash is a short fingerprint of some data. Change one character and the fingerprint changes completely. SHA-256 is a widely used example.

In a hash chain, each line’s fingerprint includes the fingerprint of the line before. Altering line 4 therefore changes line 4 and each line after it. Deleting a middle line has the same effect. Cutting the end doesn’t, so the signed head must also state the line count.

Who stands behind it?

A hash chain alone doesn’t help if someone can rebuild it after editing. So the final fingerprint is signed with a private key. Anyone with the matching public key can check the signature, and only the key holder could have made it. Ed25519 is one such scheme.

This shifts the risk to the key, so the key needs its own protection and a published fingerprint.

When did it happen?

A system’s own clock can be wrong or reset. A trusted timestamp has an independent authority confirm that the data existed at a given time.

In the EU, a qualified electronic time stamp carries a legal presumption of accurate time and data integrity, under Article 41 of eIDAS.

Can it be checked without the supplier?

If only the vendor’s platform can confirm the record, the auditor is back to trusting the vendor. The check should run on the auditor’s own computer, offline, with tooling they can inspect.

What a sealed record doesn’t prove

• It shows the record hasn’t changed since it was sealed. It can’t show the original entry was true.
• It covers what was recorded. A system that logs too little still leaves gaps.
• It doesn’t meet a legal duty for you. It’s evidence for an assessment that a person still has to make.

Questions to ask of any evidence tool

1. Can an auditor check the record without an account on your platform?
2. Where is the signing key held, and who can use it?
3. Who provides the timestamps, and are they independent of you?
4. What happens to the record if your company closes?
5. Which events are left out?

You can try altering a sample record on our homepage. It’s fictional, and the check runs in your browser. GridSEAL’s own sealed packs are planned and aren’t available yet.