Security expert Bruce Schneier has a good column in the Wall Street Journal about the importance of audit trails (keeping track of who accesses what information and when) for both privacy and security.
As the first digital president, Barack Obama is learning the hard way how difficult it can be to maintain privacy in the information age. Earlier this year, his passport file was snooped by contract workers in the State Department. In October, someone at Immigration and Customs Enforcement leaked information about his aunt’s immigration status. And in November, Verizon employees peeked at his cellphone records.
What these three incidents illustrate is not that computerized databases are vulnerable to hacking â€“ we already knew that, and anyway the perpetrators all had legitimate access to the systems they used â€“ but how important audit is as a security measure. […]
Most security against crime comes from audit. Of course we use locks and alarms, but we don’t wear bulletproof vests. The police provide for our safety by investigating crimes after the fact and prosecuting the guilty: that’s audit.
Audit helps ensure that people don’t abuse positions of trust. The cash register, for example, is basically an audit system. Cashiers have to handle the store’s money. To ensure they don’t skim from the till, the cash register keeps an audit trail of every transaction. The store owner can look at the register totals at the end of the day and make sure the amount of money in the register is the amount that should be there.
Read the whole column.