Ongoing and on-demand secure verification of audit compliance
Providing an accurate and on-demand status of audit compliance is disclosed. A security policy, agreed upon by a service provider and a service user, is provisioned in a compliance log. A service provider requests to add a first update to the compliance log, the first update indicating that a compliance action has been taken. The first update is added to the compliance log, and a first computational digest of the compliance log is added after adding the first update. An auditor of the compliance action requests to add a second update to the compliance log. The second update is added to the compliance log, and a second computational digest of the compliance log is added after adding the second update. Thereby, the user is provided a more current view of audit compliance that that can be trusted based on the tamper-proof compliance log.
1. A method of providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the method comprising:
providing a security policy, published by a service provider, in a compliance log stored on a device in the computer network, wherein the compliance log is accessible to the service provider, a user of the service provider, and an auditor;
receiving a service provider request to add a first update to the compliance log, wherein the first update indicates that a compliance action has been taken;
adding the first update to the compliance log;
adding a first computational digest of the compliance log after adding the first update, including adding a digital signature of the service provider to the first computational digest;
receiving an auditor request to add a second update to the compliance log;
adding the second update to the compliance log; and
adding a second computational digest of the compliance log after adding the second update, including adding a digital signature of the auditor to the second computational digest.
2. The method of claim 1 wherein providing the security policy in the compliance log further comprises:
providing, to the service provider and the auditor, read/write access to the compliance log, and
providing, to the user, read-only access to the compliance log.
3. The method of claim 1 wherein a plurality of copies of the compliance log are each maintained and updated independently.
4. The method of claim 1 wherein the first update includes pointer data for accessing, by the auditor, service provider records that verify the first update, and wherein the pointer data is hidden from the user.
5. The method of claim 1 wherein the second update includes a compliance indicator.
6. The method of claim 1 wherein the compliance log is implemented using blockchain.
7. An apparatus for providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:
providing a security policy, published by a service provider, in a compliance log, wherein the compliance log is accessible to the service provider, a user of the service provider, and an auditor;
receiving a service provider request to add a first update to the compliance log, wherein the first update indicates that a compliance action has been taken;
adding the first update to the compliance log;
adding a first computational digest of the compliance log after adding the first update, including adding a digital signature of the service provider to the first computational digest;
receiving an auditor request to add a second update to the compliance log;
adding the second update to the compliance log; and
adding a second computational digest of the compliance log after adding the second update, including adding a digital signature of the auditor to the second computational digest.
8. The apparatus of claim 7 wherein providing the security policy in the compliance log further comprises:
providing, to the service provider and the auditor, read/write access to the compliance log, and
providing, to the user, read-only access to the compliance log.
9. The apparatus of claim 7 wherein a plurality of copies of the compliance log are each maintained and updated independently.
10. The apparatus of claim 7 wherein the first update includes pointer data for accessing, by the auditor, service provider records that verify the first update, and wherein the pointer data is hidden from the user.
11. The apparatus of claim 7 wherein the second update includes a compliance indicator.
12. The apparatus of claim 7 wherein the compliance log is implemented using blockchain.
13. A computer program product for providing ongoing and on-demand secure verification of audit compliance for a security policy in a computer network, the computer program product comprising a non-transitory computer readable medium with computer program instructions stored thereon that, when executed, cause a computer to carry out the steps of:
providing a security policy;
receiving a service provider request to add a first update to the compliance log, wherein the first update indicates that a compliance action has been taken;
adding the first update to the compliance log;
adding a first computational digest of the compliance log after adding the first update, including adding a digital signature of the service provider to the first computational digest;
receiving an auditor request to add a second update to the compliance log;
adding the second update to the compliance log; and
adding a second computational digest of the compliance log after adding the second update, including adding a digital signature of the auditor to the second computational digest.
14. The computer program product of claim 13 wherein providing the security policy in the compliance log further comprises:
providing, to the service provider and the auditor, read/write access to the compliance log, and
providing, to a user, read-only access to the compliance log.
15. The computer program product of claim 13 wherein a plurality of copies of the compliance log are each maintained and updated independently.
16. The computer program product of claim 13 wherein the first update includes pointer data for accessing, by the auditor, service provider records that verify the first update, and wherein the pointer data is hidden from a user.
17. The computer program product of claim 13 wherein the second update includes a compliance indicator.