topic Re: Controls over data integrity in Security

Controls over data integrity

MHibbin — Wed, 14 Aug 2013 08:46:03 GMT

Hi all,

I just had a thought, not really looked into to much (work commitments) so I thought I would ask the (Splunk) world, however, apologies if this is something documented...

Are there any controls over data being falsely inserted into the index through a replication of buckets?

To expand on this a little, if someone wanted to skew results, they could potentially copy buckets from there own indexes to a production instance and rebuild the production indexes. Obviously, access controls would be the big factor here in protection and potentially auditing of the indexes, but are there any controls in place from Splunk's point of view?

Thanks,

Matt

Re: Controls over data integrity

lmyrefelt — Wed, 14 Aug 2013 09:26:31 GMT

Did you read the docs?
http://docs.splunk.com/Documentation/Splunk/latest/Security/

http://wiki.splunk.com/Community:DeployHardenedSplunk

and this;

http://docs.splunk.com/Documentation/ES/2.4/Install/Configuredataprotection

or it did not answer your question ?

Re: Controls over data integrity

MHibbin — Wed, 14 Aug 2013 09:50:52 GMT

Thanks, it kind of answers the question, however I'm not sure how well this works, e.g. if someone was able to replicate the same settings (if they have compromised the server, then chances are they can read the conf files) on their Splunk instance before copying index buckets. Maybe its just something I need to test out. But I was wondering if there was a conclusive answer.

Re: Controls over data integrity

lmyrefelt — Wed, 14 Aug 2013 10:43:56 GMT

(in these times, with the right resources, time and mindset - everything is possible)
My guess is that it comes down to how the certificates and how the actual signing / hashning of the events written to disk is handled (i.e what combination of for exemple host/mac-address/password/cert to generate ). Hopefully some developer could share some insight ... ? 🙂

Re: Controls over data integrity

MHibbin — Wed, 14 Aug 2013 12:18:06 GMT

Agreed, thanks for the valued input! 🙂