Security

Log Encryption

bherbert
Engager

We are currently have a full IT Audit going on. One piece they are looking at is SIEM. They want all logs (Event Viewer, IIS, SQL, ASA, etc.) pulled from the server and stored in a Database that's encrypted. Can Splunk do this? If not, has anyone heard of something that'll work?

Tags (2)

peterm12
New Member

We also have this question here! Are there any solutions to fulfill this SIEM requirement?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk does not have native encryption capability. You can encrypt the filesystem underneath it using an encrypted filesystem, but this is of dubious value. For one, it negatively impacts performance - for two, any user of Splunk would be able to see the cleartext data merely by searching.

Splunk can, however, sign event data to show that it was not tampered with.

I would seriously question my auditors on this requirement. What data is there of value within the logs that needs to be protected by encryption? Remember, the purpose of encryption is to keep something secret from unauthorized parties. Are your logs really that sensitive?

Cryptographic signing for the purpose of proving tampering is very valuable for logs, and I can definitely see where this would be in scope for an auditor. This, however, is NOT encryption.

You mention logs from Cisco ASAs -- the auditors DO realize that the ASA streams these over syslog in cleartext, right? If your ASA data is so valuable that you must encrypt at rest, wouldn't it be an issue that you cannot encrypt in transport?

I would make sure that the requirement for encryption is clearly defined so as to be able to meet it. It is difficult to design an easy-to-use and also very secure cryptosystem...

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...