Security

Log Encryption

bherbert
Engager

We are currently have a full IT Audit going on. One piece they are looking at is SIEM. They want all logs (Event Viewer, IIS, SQL, ASA, etc.) pulled from the server and stored in a Database that's encrypted. Can Splunk do this? If not, has anyone heard of something that'll work?

Tags (2)

peterm12
New Member

We also have this question here! Are there any solutions to fulfill this SIEM requirement?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Splunk does not have native encryption capability. You can encrypt the filesystem underneath it using an encrypted filesystem, but this is of dubious value. For one, it negatively impacts performance - for two, any user of Splunk would be able to see the cleartext data merely by searching.

Splunk can, however, sign event data to show that it was not tampered with.

I would seriously question my auditors on this requirement. What data is there of value within the logs that needs to be protected by encryption? Remember, the purpose of encryption is to keep something secret from unauthorized parties. Are your logs really that sensitive?

Cryptographic signing for the purpose of proving tampering is very valuable for logs, and I can definitely see where this would be in scope for an auditor. This, however, is NOT encryption.

You mention logs from Cisco ASAs -- the auditors DO realize that the ASA streams these over syslog in cleartext, right? If your ASA data is so valuable that you must encrypt at rest, wouldn't it be an issue that you cannot encrypt in transport?

I would make sure that the requirement for encryption is clearly defined so as to be able to meet it. It is difficult to design an easy-to-use and also very secure cryptosystem...

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...