Security

Log Encryption

bherbert
Engager

We are currently have a full IT Audit going on. One piece they are looking at is SIEM. They want all logs (Event Viewer, IIS, SQL, ASA, etc.) pulled from the server and stored in a Database that's encrypted. Can Splunk do this? If not, has anyone heard of something that'll work?

Tags (2)

peterm12
New Member

We also have this question here! Are there any solutions to fulfill this SIEM requirement?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk does not have native encryption capability. You can encrypt the filesystem underneath it using an encrypted filesystem, but this is of dubious value. For one, it negatively impacts performance - for two, any user of Splunk would be able to see the cleartext data merely by searching.

Splunk can, however, sign event data to show that it was not tampered with.

I would seriously question my auditors on this requirement. What data is there of value within the logs that needs to be protected by encryption? Remember, the purpose of encryption is to keep something secret from unauthorized parties. Are your logs really that sensitive?

Cryptographic signing for the purpose of proving tampering is very valuable for logs, and I can definitely see where this would be in scope for an auditor. This, however, is NOT encryption.

You mention logs from Cisco ASAs -- the auditors DO realize that the ASA streams these over syslog in cleartext, right? If your ASA data is so valuable that you must encrypt at rest, wouldn't it be an issue that you cannot encrypt in transport?

I would make sure that the requirement for encryption is clearly defined so as to be able to meet it. It is difficult to design an easy-to-use and also very secure cryptosystem...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...