How an audit log proves nobody edited it

transcript

An auditor asks: can you prove nobody edited this log? Seven years of records. Billions of events. One quiet edit. How would you know?

Hash each event. SHA 256 over its JSON. Event 1000's hash is abc123. Event 1001 stores that hash as its previous hash. And its own hash covers it. And so on, down the line. Every event is chained to the one before.

Now someone quietly edits event 1000. Its hash changes. Event 1001 still points at abc123. Mismatch. The tampering is visible.

But here's the catch. An attacker could recompute every hash after the edit. And the rewritten chain would verify perfectly. So checkpoint the latest hash somewhere they can't change. Write-once storage, or a signed log. Now any rewrite disagrees with the checkpoint. Caught.

The chain detects. Prevention is separate. No update or delete permissions on audit tables at all. Archives in S3 with Object Lock. In compliance mode, not even the root account can delete them. Found a wrong record? Never edit it. Append a correction event that references the original.

A hash chain makes tampering visible. A checkpoint makes it hard to hide. And locked storage makes it hard to do at all.

Full breakdown in the lecture.