topic Re: Does Splunk support FIPS 140-2 in Security

Does Splunk support FIPS 140-2

matt — Thu, 13 Jan 2011 03:27:52 GMT

Is splunk FIPS 140-2 compliant?

Re: Does Splunk support FIPS 140-2

araitz — Thu, 13 Jan 2011 04:23:59 GMT

Splunk (the software) has not been submitted for FIPS 140-2 accreditation. At this time, there are no plans that I am aware of to engage in the accreditation process.

Splunk uses OpenSSL shared libraries for all encryption, and according to openssl.org, OpenSSL will never be FIPS-140-2 validated/accredited:

http://www.openssl.org/docs/fips/fipsnotes.html

Furthermore, Splunk does not use the OpenSSL FIPS Object Model, which has been uniquely validated as FIPS-140-2 compliant. At this time, we do not anticipate moving to the OpenSSL FIPS Object Model because of compatibility and portability reasons.

Re: Does Splunk support FIPS 140-2

dmlee — Thu, 12 May 2011 08:19:32 GMT

Hi Araitz,
could you explain more detail about "we do not anticipate moving to the OpenSSL FIPS Object Model because of compatibility and portability reasons" ? thanks

Re: Does Splunk support FIPS 140-2

ChrisG — Wed, 16 Oct 2013 19:35:50 GMT

Splunk Enterprise 6 includes an OpenSSL FIPS module; see About FIPS in the Securing Splunk manual.

Note that upgrading a non-FIPS install to FIPS is not supported by Splunk – you must decide to use FIPS when your first install the product.

Re: Does Splunk support FIPS 140-2

jrodman — Tue, 10 Jun 2014 01:08:15 GMT

This answer was indeed correct when provided in 2011 for Splunk 4.x.

Re: Does Splunk support FIPS 140-2

tf_jbassford — Tue, 03 Nov 2015 02:35:39 GMT

As of version 6.3.0 of Splunk and Splunkforwarder, has Splunk Inc, gotten accreditation from NIST?

On the latest version of Splunk 6.3.0 I do see that Splunk Inc. integrated the openssl FIPS object Model for the openssl that is included with splunk, and I see that there are still statements that you cannot migrate an existing non-fips splunk to a fips-complaint splunk can someone elaborate on the details of why that migration path is NOT supported (IE: are the indexes encrypted with non fips algrorythms?, or is it just a matter of ssl cert creations that meet FIPS standards?)