The Problem With Standard Audit Logs
Every enterprise system generates audit logs. User access logs, change management records, API call histories, administrative action trails - the data is there. Regulators require it. Auditors review it. Incident responders rely on it.
There is a problem almost nobody talks about: standard audit logs are mutable.
A database administrator with the right privileges can edit a log entry. A misconfigured log rotation process can delete records. A sophisticated attacker who has compromised an administrative account can selectively remove the evidence of their actions before anyone looks.
When NIS2's Article 21(2)(g) requires 'security of log files,' when DORA's Article 9(4)(d) requires integrity of ICT operational logs, and when the EU AI Act's Article 12 requires records of AI system operation - regulators are not asking for standard mutable logs. They are asking for logs that cannot be tampered with after the fact.
Cryptographic audit trails are the technical answer to this requirement.
How Cryptographic Audit Trails Work
A cryptographic audit trail extends the standard log with two technical properties:
Hash chaining. Each log entry includes the hash of the previous entry. This creates a chain where any modification to a past entry invalidates all subsequent entries - making retroactive modification immediately detectable. This is the same mechanism used in blockchain, applied specifically to audit log integrity.
External anchoring. Periodically (every minute, every hour, every batch of events), the current chain hash is anchored to an independent, immutable ledger. This creates a time-stamped external reference point that cannot be modified even if the primary log system is compromised.
Together, these two properties mean:
- Any modification to any historical log entry breaks the chain and is immediately detectable
- Even if an attacker destroys the primary log, the external anchors preserve a verifiable record of what the log contained at each anchor point
- Regulators and auditors can independently verify that a log has not been modified, without relying on the organisation's own attestation
This is what facilitated audits with ROOTKey look like in practice - replacing 'we have logs' with 'we can prove our logs are accurate.'
import { createHash } from 'crypto';
interface AuditEntry {
timestamp: string;
eventType: string;
actorId: string;
resourceId: string;
action: string;
previousHash: string; // Hash of the previous entry in the chain
entryHash: string; // Hash of this entry including previousHash
}
function createAuditEntry(
event: Omit<AuditEntry, 'previousHash' | 'entryHash'>,
previousHash: string
): AuditEntry {
const entry: Omit<AuditEntry, 'entryHash'> = {
...event,
previousHash,
};
const entryHash = createHash('sha256')
.update(JSON.stringify(entry))
.digest('hex');
return { ...entry, entryHash };
}
function verifyAuditChain(entries: AuditEntry[]): boolean {
for (let i = 1; i < entries.length; i++) {
const expected = entries[i].previousHash;
const actual = entries[i - 1].entryHash;
if (expected !== actual) {
console.error(`Chain break detected at entry ${i}: log has been tampered with`);
return false;
}
// Verify the entry's own hash
const { entryHash, ...entryWithoutHash } = entries[i];
const computed = createHash('sha256')
.update(JSON.stringify(entryWithoutHash))
.digest('hex');
if (computed !== entryHash) {
console.error(`Entry ${i} hash invalid: entry content has been modified`);
return false;
}
}
return true;
}What This Means for Your Compliance Programme
Implementing cryptographic audit trails has three direct compliance benefits:
Satisfies the letter of the law. NIS2, DORA, and EU AI Act all require log integrity. A cryptographic audit trail is the technically defensible implementation of this requirement - unlike a standard log that a DBA could modify.
Reduces audit preparation time. When an auditor or regulator requests evidence that logs have not been tampered with, a cryptographic audit trail provides the proof automatically. Standard logs require attesting to security controls - a process that takes time and carries liability risk.
Strengthens incident investigations. If a security incident occurs, a cryptographic audit trail provides forensic evidence that cannot be challenged as having been modified after the fact. This is critical for insurance claims, regulatory notifications, and potential litigation.
ROOTKey's audit use case provides cryptographic audit trails as a managed service, integrating with your existing systems. Start a free trial and generate your first cryptographic audit trail today.
Get cyber-resilience insights in your inbox
Practical, audit-ready guidance on data integrity, compliance and continuity - delivered as we publish.