An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?