Security

Log Encryption

bherbert
Engager

We are currently have a full IT Audit going on. One piece they are looking at is SIEM. They want all logs (Event Viewer, IIS, SQL, ASA, etc.) pulled from the server and stored in a Database that's encrypted. Can Splunk do this? If not, has anyone heard of something that'll work?

Tags (2)

peterm12
New Member

We also have this question here! Are there any solutions to fulfill this SIEM requirement?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk does not have native encryption capability. You can encrypt the filesystem underneath it using an encrypted filesystem, but this is of dubious value. For one, it negatively impacts performance - for two, any user of Splunk would be able to see the cleartext data merely by searching.

Splunk can, however, sign event data to show that it was not tampered with.

I would seriously question my auditors on this requirement. What data is there of value within the logs that needs to be protected by encryption? Remember, the purpose of encryption is to keep something secret from unauthorized parties. Are your logs really that sensitive?

Cryptographic signing for the purpose of proving tampering is very valuable for logs, and I can definitely see where this would be in scope for an auditor. This, however, is NOT encryption.

You mention logs from Cisco ASAs -- the auditors DO realize that the ASA streams these over syslog in cleartext, right? If your ASA data is so valuable that you must encrypt at rest, wouldn't it be an issue that you cannot encrypt in transport?

I would make sure that the requirement for encryption is clearly defined so as to be able to meet it. It is difficult to design an easy-to-use and also very secure cryptosystem...

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...