Log Protection

[All Actors]
1. Secure Logging Mechanisms: Implement robust access control and encryption (at rest and in transit) for AI related logs covering training, validation and inference. Capture relevant metadata such as model versions, data sources, input parameters, and system events to facilitate in-depth oversight.

2. Immutable and Tamper-Evident Storage: Store logs in an immutable, tamper-evident repository to protect against unauthorized modification or deletion. Employ cryptographic integrity checks or other mechanisms that enable prompt detection of log tampering.

3. Integration with Security Monitoring: Correlate AI logs with broader security monitoring systems to detect anomalies (e.g., unexpected inference spikes, unapproved dataset uploads). Define workflows to escalate suspicious events for investigation and remediation.

4. Privacy-Preserving Practices: Apply techniques like pseudonymization or data minimization to reduce exposure of sensitive information within AI logs. Align log retention periods and handling with applicable data protection requirements.

5. Regular Review and Alerting: Conduct scheduled reviews of AI logs for unauthorized model changes, suspicious hyperparameter modifications, or attempts to bypass controls. Configure automated alerts to notify incident response teams of critical events (e.g., potential model tampering, unauthorized data access).

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for protecting cloud infrastructure audit records from unauthorized access, modification, and deletion to understand their implementation of security controls and monitoring procedures for infrastructure logs and customer workload records. Verify their understanding of technical safeguards for cloud logging systems, access control mechanisms for customer isolation protection, and procedures for detecting and responding to unauthorized attempts to access, modify, or delete cloud infrastructure audit records.

2. Inspecting Records and Documents

2.1 Confirm technical safeguards are in place to enforce read-only permissions on cloud infrastructure audit logs containing customer workloads and resource allocation data.

2.2 Review documentation for secure cloud infrastructure log storage practices, including encryption of customer data logs and access control for infrastructure operation records.

2.3 Validate that cloud infrastructure logs are retained in tamper-evident storage formats or solutions to protect customer isolation and service availability.

2.4 Check if cloud infrastructure logs are segregated from operational logs and protected independently with customer-focused controls.

2.5 Verify access controls for cloud infrastructure logs follow least privilege and RBAC principles, preventing unauthorized access to customer workload data and infrastructure configurations.

2.6 Review the audit trail for access attempts to cloud infrastructure log storage locations containing sensitive customer and infrastructure information.

2.7 Confirm periodic testing or review of cloud infrastructure log protection mechanisms is performed to ensure customer isolation and infrastructure security compliance.

2.8 Examine backup and recovery procedures for cloud infrastructure audit records to ensure protection extends to archived customer workload logs and infrastructure operation data.

2.9 Validate monitoring and alerting mechanisms for detecting unauthorized access attempts to cloud infrastructure logs, customer data modification attempts, or deletion attempts on infrastructure records.

2.10 Review incident response procedures specifically related to cloud infrastructure audit record compromise, customer isolation breaches, or suspected unauthorized access to infrastructure logging systems.

2.11 Verify logs across all cloud-hosted services are protected using encryption, RBAC, and WORM settings.

2.12 Confirm multi-tenant isolation mechanisms prevent unauthorized access to logs.

2.13 Check that logs are replicated across regions without compromising their integrity.

2.14 Validate continuous monitoring tools alert on unauthorized access attempts to logs.

2.15 Confirm logs of audit services themselves (e.g., CloudTrail, StackDriver) are not modifiable.

2.16 Review lifecycle policies to ensure deletion controls follow compliance retention requirements.

2.17 Ensure third-party SIEM integrations do not compromise protection of native logs.