Records retention: addressing insider threats to data integrity
Marianne Winslett · International Conference on Management of Data · 2011
Inaccurate financial statements from major companies, dead people who still vote in elections, world-class gymnasts with uncertain birth dates: insiders often have the power and ability to make inappropriate changes to the content of electronic records. As electronic records replace paper records, it becomes easy to make such alterations without leaving behind evidence that can be used to detect the changes and determine who made them. The US Sarbanes-Oxley Act is perhaps the most (in)famous law that addresses these problems, but it is just one of many regulations that require long-term high-integrity retention of electronic records, all with the goal of ensuring that societal trust in business and government at reasonable cost.In this talk, we will discuss some of the technical challenges posed by the need for tamper-proof retention of records. We will describe how industry has responded to these challenges, the security weaknesses in current product offerings, and the role that researchers and government can play in addressing these weaknesses. We will give an overview of research progress to date and describe the major open research problems in this area.