What is the role of logging integrity and tamper-evidence in security monitoring?

• A. Logs are used only for performance metrics.
• B. Logging is optional in security monitoring.
• C. Storing logs in a non-protected location is best.
• D. Ensures logs are reliable and not tampered with through append-only storage, cryptographic hashes, and tamper-evident systems.

Answer: (D)

Maintaining the integrity and tamper-evidence of logs is essential because security monitoring depends on trustworthy data to detect, investigate, and prove what happened. Logs provide a timeline of events; if someone can delete or alter them, you lose visibility and may not be able to determine the true sequence of actions or prove a breach.

Using append-only storage prevents new entries from overwriting or erasing older ones, making it much harder to conceal activities. Cryptographic hashes or signatures let you verify that logs have not been changed since they were written—any tampering would be detectable. Tamper-evident systems, such as protected logging endpoints, write-once media, or time-stamped records, provide clear evidence of access and modifications, supporting the chain of custody required for forensics and compliance.

That combination ensures logs remain reliable for detection, investigation, and audits. Logs are not just for performance metrics, they are a core source of truth for security. They must be protected, because placing them in a non-protected location or treating logging as optional would undermine the ability to respond to incidents and meet regulatory requirements.