ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Accountability relies on the ability to attribute each action to a specific identity and to prove that the recorded evidence has not been altered. Storing logs locally, where the same users who generated the events can modify or erase them, breaks that chain of evidence. A centrally managed, write-once (immutable) logging solution with tightly restricted administrative access protects the integrity and availability of audit records, allowing investigators to trace events back to responsible parties. Encrypting audit files adds confidentiality but does not stop authorized users from deleting or rewriting them. Weekly server backups and multi-factor authentication are valuable practices, yet neither specifically ensures that log evidence remains tamper-proof and attributable throughout the system's life cycle.