Topic starter
22/06/2026 10:05 am
TL;DR: The security issue is not just access control, but whether privileged session evidence can still be trusted after it leaves the session boundary, according to Pomerium. Its tamper-evident SSH session recording model treats recordings as immutable, independently verifiable evidence, with audit trails and digest checks that can detect modification during upload or storage.
Editorial analysis by NHI Mgmt Group, based on content published by Pomerium: “How We Designed a Tamper-Evident SSH Recording System for Zero-Trust infrastructure”.
Key questions
Q: What breaks when SSH session recordings are not immutable?
A: The evidence chain breaks.
Q: Why do session recordings need audit trails as well as storage controls?
A: Storage controls limit what can be changed, but audit trails show who accessed the evidence and whether access happened through the approved custody path.
Q: How should teams decide whether an SSH recording is trustworthy enough for review?
A: They should check whether the recording is immutable, whether its digest still matches after upload, and whether every access path is correlatable across the proxy and storage layer.
Practitioner guidance
- Define recordings as governed evidence Classify SSH recordings as protected audit evidence with explicit ownership, retention, and access rules rather than generic operational logs.
- Require immutable storage for session artefacts Use object locking, retention policies, or equivalent controls so recordings cannot be rewritten in place after capture.
- Verify digests after upload Check that the session digest generated at capture still matches the stored object before accepting the recording as trustworthy.
Bottom line: SSH session recordings can become a governance liability if their custody and integrity are not controlled as tightly as the live session itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:49 am
Recording evidence has become an identity governance object, not a storage artifact. Once SSH session data is used for audit, compliance, or investigation, its trustworthiness matters as much as the access decision that produced it. That shifts the control question from simple retention to verifiable custody and tamper detection. For practitioners, the recording pipeline deserves the same governance attention as the privileged session itself.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between access control and evidence integrity for privileged sessions?
A: Access control answers who may open the session or the recording. Evidence integrity answers whether the recording still reflects the original event after storage, replay, or download. In zero trust, both matter because a legitimate viewer can still be handed a tampered artefact.
👉 Read our full editorial: Tamper-evident SSH session recording extends zero trust evidence