Skip to content
Software Architecture Guide

Accountability

Explanation

Section titled “Explanation”

ISO/IEC 25010 is a standard model of software quality (see the article ISO/IEC 25010 Product Quality Model). It defines accountability as the degree to which an entity’s actions can be traced uniquely to that entity. The 2023 wording describes it as a capability of a product to enable this tracing.

The NIST definition adds a purpose. You trace activities on a system to individuals, who may then be held responsible for their actions.

Accountability sits beside three other security sub-characteristics:

  • Authenticity is about proving that an identity is the one claimed. See the article Authenticity.
  • Non-repudiation is about proving that actions or events took place, so nobody can deny them later. See the article Nonrepudiation.
  • Confidentiality means data is accessible only to authorized parties. See the article Confidentiality.

Accountability depends on recording the right identity. OWASP warns that an attacker may cause the wrong identity to be logged. That hides the responsible party and defeats accountability.

Logs are a main source of evidence, so they need protection. OWASP advises building in tamper detection, so you know if a record was changed or deleted. It also advises copying log data to read-only media as soon as possible.

One user action can touch several components. An interaction identifier links all relevant events of one user interaction. This lets you correlate records across components. See the article Correlation Identifier.

Example

Section titled “Example”

A web shop lets staff change product prices. Each change is logged with the staff member’s identity. The same interaction identifier appears in every component that handles the request. Copies of the logs go quickly to read-only media. A tamper check flags any altered record. After a wrong price appears, the team follows the identifier across components and finds who made the change.

Trade-offs

Section titled “Trade-offs”

Logging personal data conflicts with privacy. OWASP suggests avoiding personal data in logs or de-identifying it, for example by pseudonymization (replacing identifying values with stand-ins). The identity you log must still be enough to trace the action, so balance the two goals deliberately.

Checks

Section titled “Checks”
  • The document states that actions must be traceable uniquely to the acting entity.
  • Log records have tamper detection, so modified or deleted records are noticed.
  • An interaction identifier links the events of one user interaction across components.
  • The document says how personal data in logs is avoided or de-identified.
  • Log data is copied to read-only media quickly.
Section titled “Related”

Sources

Section titled “Sources”