SlideShare uma empresa Scribd logo

Data Obfuscation in Splunk Enterprise: Anonymization, Pseudonymization and Encryption Techniques

•
•
J
jenny_splunk

This document discusses data obfuscation techniques in Splunk Enterprise, including anonymization and pseudonymization. It covers securing data in flight using encryption and authentication. For data at rest, it discusses integrity controls and encryption using OS, devices, or Vormetric. It then details how Splunk supports anonymization through SEDCMD transforms or at search time. Pseudonymization techniques include hashing or duplicating data to different indexes. The document demonstrates modular inputs and a custom data handler to encrypt and anonymize fields before indexing.

Tecnologia
1 de 44
Copyright © 2015 Splunk Inc. Data Obfuscation in Splunk Enterprise
Agenda The Drivers Data-in-Flight Data-at-Rest Data Obfuscation within Splunk Enterprise – Anonymization – Pseudonymization – Summing Up Demonstration
Agenda The Drivers Data-in-Flight Data-at-Rest Data Obfuscation within Splunk Enterprise – Anonymization – Pseudonymization – Summing Up Demonstration
The Drivers risk minimization strategy
The Drivers Collect and Process Data 5 Stakeholder* Workers Council Data Privacy Officer GDPR Privacy Shield PCI …. Requirements* Anonymization Pseudonymization Pseudonymization Encryption RAW Event archival for 1 year – 3 month online *Examples only | Your legal department will assist you.
The Drivers Collect and Process Data 6 Stakeholder* Workers Council Data Privacy Officer GDPR Privacy Shield PCI …. Requirements* Anonymization Pseudonymization Pseudonymization Encryption RAW Event archival for 1 year – 3 month online *Examples only | Your legal department will assist you. You need to ensure to have a flexible platform that fits your needs – even if they change!
Spoilt for Choice What – Confidentiality / Integrity / Authenticity Where – At Source / In Flight / At Rest / Presentation Layer How – Anonymization / Pseudonymization Usability, Maintainability, Cost, … 7
Data-in-Flight
Data-in-Flight Ways to secure your connections to Splunk Enterprise Encryption and/or authentication using your own certificates for: – Communications between the browser and Splunk Web – Communication from Splunk forwarders to indexers – Other types of communication, such as communications between Splunk instances over the management port 9 Type of exchange Client function Server function Encryption Certificate Authentication Common Name checking Type of data exchanged Browser to Splunk Web Browser Splunk Web NOT enabled by default dictated by client (browser) dictated by client (browser) search term results Inter-Splunk communication Splunk Web splunkd enabled by default NOT enabled by default NOT enabled by default search term results Forwarding splunkd as a forwarder splunkd as an indexer NOT enabled by default NOT enabled by default NOT enabled by default data to be indexed Deployment server to indexers splunkd as a forwarder splunkd as an indexer NOT enabled by default NOT enabled by default NOT enabled by default Not recommended. Use Pass4SymmKey instead. http://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwithSSL
Data-at-Rest
Data-at-Rest Integrity Ways to ensure the integrity of your machine data stored in Splunk Compute SHA256 hash for every slice in hot bucket When bucket rolls from hot to warm, create SHA256 hash of the file containing the hashes of the individual slices Can verify integrity from the CLI Enable for an entire index 11 http://docs.splunk.com/Documentation/Splunk/latest/Security/Dataintegritycontrol http://blogs.splunk.com/2015/10/28/data-integrity-is-back-baby/
Data-at-Rest Encryption Entire data set Encryption of all data Splunk writes to disk (index, raw data, metadata) Pros: – Easy to implement with OS or device means / covers all data / transparent to Splunk Cons: – All indexes on a given file system / performance overhead / limited security against rogue users
Data-at-Rest Encryption Transparent Encryption-at-Rest with Vormetrics 13 https://www.vormetric.com/sites/default/files/wp-splunk-vormetric.pdf
Data Obfuscation within Splunk
What is Anonymization? Anonymization of data means processing it with the aim of irreversibly preventing the identification of the individual to whom it relates. 15 2016-12-24 09:00 host1 mm28522 login successful 2016-12-24 09:00 host1 ****** login successful
What is Pseudonymization? Pseudonymization of data means replacing any identifying characteristics of data with a pseudonym, or, in other words, a value which does not allow the data subject to be directly identified. 16 2016-12-24 09:00 host1 mm28522 login successful 2016-12-24 09:00 host1 0fc43cd589ec74ddb677501adf6c295b login successful
Anonymization
Anonymization At Rest / At Indexing Time / Modify Raw Events SEDCMD or TRANSFORMS props.conf [source::.../accounts.log] SEDCMD-accounts = s/ssn=d{5}(d{4})/ssn=xxxxx1/g [source::.../another.log] TRANSFORMS-anon=ssn-anon transforms.conf [ssn-anon] REGEX=(ssn=)d{5}(d{4}) FORMAT=$1xxxxx$2 DEST_KEY=_raw 18 https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
Anonymization Presentation Layer / At Search Time Locked down User – Pre-defined App with dashboard access only – No search app, no raw search, no raw event drill down | eval username = “******“ 19 https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Anonymizedata
Pseudonymization
Pseudonymization Presentation Layer / At Search Time Locked down User – Pre-defined App with dashboard access only – No search app, no raw search, no raw event drill down | eval username = sha256(username) or use your own custom search command 21 https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Anonymizedata
Pseudonymization At Source / Application Data pseudonymization before Splunk picks it up Pros: – Managed earliest as possible in the process – Data source owner responsible – Data-Privacy challenge solved for data stored on source as well Cons: – Individual solution per data source/type/method required
Pseudonymization Event Duplication Into Different Indexes User authorization managed via role based access control for indexes Pros: – Easy to implement and maintain, easy usability, low complexity Cons: – Storage costs (can be limited with tsidx retention but slower search) – License costs idx_cleartext idx_pseudonym
Pseudonymization Using Summary Index Scheduled summary search transforms the data and stores it in a new summary index Pros: – Summary index does not count against license – Everything GUI managed – Allows grouped aggregation (anonymization, too) Cons: – Regular search utilizing resources – Breaks out-of-the-box CIM (source=search name, sourcetype=stash, original sourcetype moved to orig_sourcetype) idx_cleartext idx_summary
Pseudonymization Modular Input Data de-centralized piped through a custom method using a modular input Pros: – High flexibility on encryption, hashing etc. methods and requirements – Processing can be done decentralized at each forwarder to distribute processing load Cons: – Scripting required for modular inputs
Summing Up
Summing Up Many possible ways – each has pros and cons Anonymization – Data aggregation might be an additional layer as specific access to a specific file from a specific host does potentially allow identification back to an individual Pseudonymization – Requires a proper concept to ensure the pros and cons are known and accepted in advance such that impact and additional complexity is understood in production and operation use We are transparent on possibilities, allow multiple ways and levels which are available for data obfuscation. Choose the best and most efficient combination for you!
Demonstration
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsIntro Modular Input Documentation
Modular Input Search on Splunkbase https://splunkbase.splunk.com/apps/#/search/Modular%20Input/
Protocol Data Inputs Different input protocols Custom data handler allows to pre-process data – Polyglot: many programming languages can be used. E.g. Java, JavaScript, Python, … Different output protocols Data Handler https://splunkbase.splunk.com/app/1901/
Demo Scenarios Encryption Modular Input Log file with sensitive data Read log file data File Monitor input (UF) Protocol Data Inputs Data Handler encrypts field values Data sent and stored Decryption Custom Search Command Events in Splunk with encrypted field values User is authorized to use custom search command Custom search command Decrypts fields Anonymization SEDCMD Log file with sensitive data Read log file data File Monitor Input (UF) Pipeline Apply SEDCMD and replace data Data stored 32
Log File With Sensitive Data – cleartext.log 33 Field Description Action we want to take first First name Encrypt with AES name Last Name Encrypt with AES dob Date of Birth Encrypt with AES uid Employee ID Anonymize
UF File Monitor – Forward Data 34
Receiving side – Protocol Data Inputs 35
Protocol Data Inputs Configuration – Protocols 36
Protocol Data Inputs Configuration – Data Handler 37 Parameters for custom data handler: • regex: identify fields to encrypt • AES_Key_File: Key to use to encrypt PDI Custom data handler (here: Java)
Processed Data 38
Decrypt Data – Custom Search Command 39
Anonymization 40
SEDCMD for Anonymization of uid Field (props.conf) 41
Q & A
Splunk User Groups EMEA 43 https://usergroups.splunk.com/
Thank You!

Recomendados

Data Obfuscation in Splunk Enterprise
Data Obfuscation in Splunk EnterpriseData Obfuscation in Splunk Enterprise
Data Obfuscation in Splunk EnterpriseSplunk
 
Splunk Architecture
Splunk ArchitectureSplunk Architecture
Splunk ArchitectureKishore Chaganti
 
Splunk 101
Splunk 101Splunk 101
Splunk 101Splunk
 
Splunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfSplunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfnitinscribd
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk CloudSplunk
 
SplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunk
 
Splunk overview
Splunk overviewSplunk overview
Splunk overviewDaniel Hernandez
 
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK FrameworkLeveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK FrameworkSplunk
 

Recomendados

Data Obfuscation in Splunk Enterprise
Data Obfuscation in Splunk EnterpriseData Obfuscation in Splunk Enterprise
Data Obfuscation in Splunk EnterpriseSplunk
 
Splunk Architecture
Splunk ArchitectureSplunk Architecture
Splunk ArchitectureKishore Chaganti
 
Splunk 101
Splunk 101Splunk 101
Splunk 101Splunk
 
Splunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfSplunk 6.4 Administration.pdf
Splunk 6.4 Administration.pdfnitinscribd
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk CloudSplunk
 
SplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunkLive 2011 Beginners Session
SplunkLive 2011 Beginners SessionSplunk
 
Splunk overview
Splunk overviewSplunk overview
Splunk overviewDaniel Hernandez
 
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK FrameworkLeveraging Splunk Enterprise Security with the MITRE’s ATT&CK Framework
Leveraging Splunk Enterprise Security with the MITRE’s ATT&CK FrameworkSplunk
 
SplunkLive! Data Models 101
SplunkLive! Data Models 101SplunkLive! Data Models 101
SplunkLive! Data Models 101Splunk
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Splunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaSplunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaEdureka!
 
OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)Jooho Lee
 
Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...Splunk
 
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?OpenStack Korea Community
 
SplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use CaseSplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use CaseSplunk
 
Splunk
SplunkSplunk
SplunkKnoldus Inc.
 
Best Practices for Forwarder Hierarchies
Best Practices for Forwarder HierarchiesBest Practices for Forwarder Hierarchies
Best Practices for Forwarder HierarchiesSplunk
 
Getting Started with Splunk
Getting Started with SplunkGetting Started with Splunk
Getting Started with SplunkSplunk
 
Best Practices for Splunk Deployments
Best Practices for Splunk DeploymentsBest Practices for Splunk Deployments
Best Practices for Splunk DeploymentsSplunk
 
Why Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik RamasamyWhy Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik RamasamyStreamNative
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console Splunk
 
Workshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-moWorkshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-moMohamad Hassan
 
Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)BGA Cyber Security
 
AIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AIAIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AITimothy Spann
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2 Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2 Splunk
 
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorApache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorDatabricks
 
cisco csr1000v
cisco csr1000vcisco csr1000v
cisco csr1000vMing914298
 
Press Release_Skills Day_Post2
Press Release_Skills Day_Post2Press Release_Skills Day_Post2
Press Release_Skills Day_Post2Howard Rose
 
SplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin InternationalSplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin InternationalSplunk
 

Mais conteúdo relacionado

Mais procurados

SplunkLive! Data Models 101
SplunkLive! Data Models 101SplunkLive! Data Models 101
SplunkLive! Data Models 101Splunk
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk OverviewSplunk
 
Splunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaSplunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaEdureka!
 
OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)Jooho Lee
 
Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...Splunk
 
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?OpenStack Korea Community
 
SplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use CaseSplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use CaseSplunk
 
Best Practices for Forwarder Hierarchies
Best Practices for Forwarder HierarchiesBest Practices for Forwarder Hierarchies
Best Practices for Forwarder HierarchiesSplunk
 
Getting Started with Splunk
Getting Started with SplunkGetting Started with Splunk
Getting Started with SplunkSplunk
 
Best Practices for Splunk Deployments
Best Practices for Splunk DeploymentsBest Practices for Splunk Deployments
Best Practices for Splunk DeploymentsSplunk
 
Why Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik RamasamyWhy Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik RamasamyStreamNative
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console Splunk
 
Workshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-moWorkshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-moMohamad Hassan
 
Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)BGA Cyber Security
 
AIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AIAIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AITimothy Spann
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2 Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2 Splunk
 
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorApache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorDatabricks
 
cisco csr1000v
cisco csr1000vcisco csr1000v
cisco csr1000vMing914298
 

Mais procurados (20)

SplunkLive! Data Models 101
SplunkLive! Data Models 101SplunkLive! Data Models 101
SplunkLive! Data Models 101
 
Splunk Overview
Splunk OverviewSplunk Overview
Splunk Overview
 
Splunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | EdurekaSplunk Tutorial for Beginners - What is Splunk | Edureka
Splunk Tutorial for Beginners - What is Splunk | Edureka
 
OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)OpenSCAP Overview(security scanning for docker image and container)
OpenSCAP Overview(security scanning for docker image and container)
 
Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...Power of Splunk Search Processing Language (SPL) ...
Power of Splunk Search Processing Language (SPL) ...
 
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
[OpenStack Days Korea 2016] Track1 - 카카오는 오픈스택 기반으로 어떻게 5000VM을 운영하고 있을까?
 
SplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use CaseSplunkLive! Munich 2018: Siemens Security Use Case
SplunkLive! Munich 2018: Siemens Security Use Case
 
Splunk
SplunkSplunk
Splunk
 
Best Practices for Forwarder Hierarchies
Best Practices for Forwarder HierarchiesBest Practices for Forwarder Hierarchies
Best Practices for Forwarder Hierarchies
 
Getting Started with Splunk
Getting Started with SplunkGetting Started with Splunk
Getting Started with Splunk
 
Best Practices for Splunk Deployments
Best Practices for Splunk DeploymentsBest Practices for Splunk Deployments
Best Practices for Splunk Deployments
 
Why Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik RamasamyWhy Splunk Chose Pulsar_Karthik Ramasamy
Why Splunk Chose Pulsar_Karthik Ramasamy
 
Splunk Distributed Management Console
Splunk Distributed Management Console Splunk Distributed Management Console
Splunk Distributed Management Console
 
Workshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-moWorkshop splunk 6.5-saint-louis-mo
Workshop splunk 6.5-saint-louis-mo
 
Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)Tcpdump ile Trafik Analizi(Sniffing)
Tcpdump ile Trafik Analizi(Sniffing)
 
AIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AIAIDEVDAY_ Data-in-Motion to Supercharge AI
AIDEVDAY_ Data-in-Motion to Supercharge AI
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2 Splunk Cloud and Splunk Enterprise 7.2
Splunk Cloud and Splunk Enterprise 7.2
 
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorApache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
 
cisco csr1000v
cisco csr1000vcisco csr1000v
cisco csr1000v
 

Destaque

Press Release_Skills Day_Post2
Press Release_Skills Day_Post2Press Release_Skills Day_Post2
Press Release_Skills Day_Post2Howard Rose
 
SplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin InternationalSplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin InternationalSplunk
 
SplunkLive! Wien 2016 - Use Case TTTech Computertechnik
SplunkLive! Wien 2016 - Use Case TTTech ComputertechnikSplunkLive! Wien 2016 - Use Case TTTech Computertechnik
SplunkLive! Wien 2016 - Use Case TTTech ComputertechnikSplunk
 
Viasat Customer Presentation
Viasat Customer PresentationViasat Customer Presentation
Viasat Customer PresentationSplunk
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk
 
Get your Service Intelligence off to a Flying Start
Get your Service Intelligence off to a Flying StartGet your Service Intelligence off to a Flying Start
Get your Service Intelligence off to a Flying StartSplunk
 
SplunkLive! Frankfurt 2016 - mail.de Use Case
SplunkLive! Frankfurt 2016 - mail.de Use CaseSplunkLive! Frankfurt 2016 - mail.de Use Case
SplunkLive! Frankfurt 2016 - mail.de Use CaseSplunk
 
Ecetera uses Splunk to facilitate DevOps in forex
Ecetera uses Splunk to facilitate DevOps in forexEcetera uses Splunk to facilitate DevOps in forex
Ecetera uses Splunk to facilitate DevOps in forexOcean Software
 
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...Splunk
 
Splunk Implementation and Usage - Garmin
Splunk Implementation and Usage - GarminSplunk Implementation and Usage - Garmin
Splunk Implementation and Usage - GarminSplunk
 
Splunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of ThingsSplunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of ThingsSplunk
 
SplunkLive! Customer Presentation - Satcom Direct
SplunkLive! Customer Presentation - Satcom DirectSplunkLive! Customer Presentation - Satcom Direct
SplunkLive! Customer Presentation - Satcom DirectSplunk
 
Driving Efficiency with Splunk Cloud at Gatwick Airport
Driving Efficiency with Splunk Cloud at Gatwick AirportDriving Efficiency with Splunk Cloud at Gatwick Airport
Driving Efficiency with Splunk Cloud at Gatwick AirportSplunk
 
Splunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk
 
Customer Presentation
Customer PresentationCustomer Presentation
Customer PresentationSplunk
 
Experian Customer Presentation
Experian Customer PresentationExperian Customer Presentation
Experian Customer PresentationSplunk
 
dlux - Splunk Technical Overview
dlux - Splunk Technical Overviewdlux - Splunk Technical Overview
dlux - Splunk Technical OverviewDavid Lutz
 
Softcat Splunk Discovery Day Manchester, March 2017
Softcat Splunk Discovery Day Manchester, March 2017Softcat Splunk Discovery Day Manchester, March 2017
Softcat Splunk Discovery Day Manchester, March 2017Splunk
 

Destaque (20)

Press Release_Skills Day_Post2
Press Release_Skills Day_Post2Press Release_Skills Day_Post2
Press Release_Skills Day_Post2
 
SplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin InternationalSplunkLive! Customer Presentation - Garmin International
SplunkLive! Customer Presentation - Garmin International
 
SplunkLive! Wien 2016 - Use Case TTTech Computertechnik
SplunkLive! Wien 2016 - Use Case TTTech ComputertechnikSplunkLive! Wien 2016 - Use Case TTTech Computertechnik
SplunkLive! Wien 2016 - Use Case TTTech Computertechnik
 
Viasat Customer Presentation
Viasat Customer PresentationViasat Customer Presentation
Viasat Customer Presentation
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
 
Get your Service Intelligence off to a Flying Start
Get your Service Intelligence off to a Flying StartGet your Service Intelligence off to a Flying Start
Get your Service Intelligence off to a Flying Start
 
SplunkLive! Frankfurt 2016 - mail.de Use Case
SplunkLive! Frankfurt 2016 - mail.de Use CaseSplunkLive! Frankfurt 2016 - mail.de Use Case
SplunkLive! Frankfurt 2016 - mail.de Use Case
 
Ecetera uses Splunk to facilitate DevOps in forex
Ecetera uses Splunk to facilitate DevOps in forexEcetera uses Splunk to facilitate DevOps in forex
Ecetera uses Splunk to facilitate DevOps in forex
 
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...
AWS Loft London: Finding the signal in the noise - Effective SecOps with Soph...
 
Splunk Implementation and Usage - Garmin
Splunk Implementation and Usage - GarminSplunk Implementation and Usage - Garmin
Splunk Implementation and Usage - Garmin
 
Splunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of ThingsSplunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of Things
 
SplunkLive! Customer Presentation - Satcom Direct
SplunkLive! Customer Presentation - Satcom DirectSplunkLive! Customer Presentation - Satcom Direct
SplunkLive! Customer Presentation - Satcom Direct
 
Driving Efficiency with Splunk Cloud at Gatwick Airport
Driving Efficiency with Splunk Cloud at Gatwick AirportDriving Efficiency with Splunk Cloud at Gatwick Airport
Driving Efficiency with Splunk Cloud at Gatwick Airport
 
Splunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into SplunkSplunk conf2014 - Onboarding Data Into Splunk
Splunk conf2014 - Onboarding Data Into Splunk
 
Customer Presentation
Customer PresentationCustomer Presentation
Customer Presentation
 
Splunk6.3 소개서 2015_11
Splunk6.3 소개서 2015_11Splunk6.3 소개서 2015_11
Splunk6.3 소개서 2015_11
 
Experian Customer Presentation
Experian Customer PresentationExperian Customer Presentation
Experian Customer Presentation
 
dlux - Splunk Technical Overview
dlux - Splunk Technical Overviewdlux - Splunk Technical Overview
dlux - Splunk Technical Overview
 
Splunk 교육자료 v1.2
Splunk 교육자료 v1.2Splunk 교육자료 v1.2
Splunk 교육자료 v1.2
 
Softcat Splunk Discovery Day Manchester, March 2017
Softcat Splunk Discovery Day Manchester, March 2017Softcat Splunk Discovery Day Manchester, March 2017
Softcat Splunk Discovery Day Manchester, March 2017
 

Semelhante a Data Obfuscation in Splunk Enterprise: Anonymization, Pseudonymization and Encryption Techniques

Getting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionGetting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionGetting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionSplunk
 
Getting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnGetting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseShannon Cuthbertson
 
SplunkLive! Getting Started with Splunk Enterprise
SplunkLive! Getting Started with Splunk EnterpriseSplunkLive! Getting Started with Splunk Enterprise
SplunkLive! Getting Started with Splunk EnterpriseSplunk
 
Getting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnGetting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnSplunk
 
SplunkLive! London 2016 Splunk Overview
SplunkLive! London 2016 Splunk OverviewSplunkLive! London 2016 Splunk Overview
SplunkLive! London 2016 Splunk OverviewSplunk
 
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionGetting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionSplunk
 
Getting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionGetting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionSplunk
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Splunk forwarders tech_brief
Splunk forwarders tech_briefSplunk forwarders tech_brief
Splunk forwarders tech_briefGreg Hanchin
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseSplunk
 
Customer Presentation - Financial Services Organization
Customer Presentation - Financial Services OrganizationCustomer Presentation - Financial Services Organization
Customer Presentation - Financial Services OrganizationSplunk
 
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...Precisely
 
Splunk best practices
Splunk best practicesSplunk best practices
Splunk best practicesJilali HARITI
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk CloudSplunk
 
Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Splunk
 

Semelhante a Data Obfuscation in Splunk Enterprise: Anonymization, Pseudonymization and Encryption Techniques (20)

Getting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout SessionGetting Started with Splunk Enterprise Hands-On Breakout Session
Getting Started with Splunk Enterprise Hands-On Breakout Session
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionGetting Started with Splunk Breakout Session
Getting Started with Splunk Breakout Session
 
Getting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnGetting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-On
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
SplunkLive! Getting Started with Splunk Enterprise
SplunkLive! Getting Started with Splunk EnterpriseSplunkLive! Getting Started with Splunk Enterprise
SplunkLive! Getting Started with Splunk Enterprise
 
Getting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-OnGetting Started with Splunk Enterprise Hands-On
Getting Started with Splunk Enterprise Hands-On
 
SplunkLive! London 2016 Splunk Overview
SplunkLive! London 2016 Splunk OverviewSplunkLive! London 2016 Splunk Overview
SplunkLive! London 2016 Splunk Overview
 
Getting Started with Splunk Breakout Session
Getting Started with Splunk Breakout SessionGetting Started with Splunk Breakout Session
Getting Started with Splunk Breakout Session
 
Getting started with Splunk Breakout Session
Getting started with Splunk Breakout SessionGetting started with Splunk Breakout Session
Getting started with Splunk Breakout Session
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Splunk forwarders tech_brief
Splunk forwarders tech_briefSplunk forwarders tech_brief
Splunk forwarders tech_brief
 
Getting Started with Splunk Enterprise
Getting Started with Splunk EnterpriseGetting Started with Splunk Enterprise
Getting Started with Splunk Enterprise
 
Splunk Insights
Splunk InsightsSplunk Insights
Splunk Insights
 
Customer Presentation - Financial Services Organization
Customer Presentation - Financial Services OrganizationCustomer Presentation - Financial Services Organization
Customer Presentation - Financial Services Organization
 
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...
Mainframe Customer Education Webcast: New Ironstream Facilities for Enhanced ...
 
Splunk best practices
Splunk best practicesSplunk best practices
Splunk best practices
 
Splunk Cloud
Splunk CloudSplunk Cloud
Splunk Cloud
 
Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On) Getting Started with Splunk (Hands-On)
Getting Started with Splunk (Hands-On)
 

Mais de jenny_splunk

Analytics with splunk - Advanced
Analytics with splunk - AdvancedAnalytics with splunk - Advanced
Analytics with splunk - Advancedjenny_splunk
 
SplunkLive Oslo/Stockholm Beginner Workshop
SplunkLive Oslo/Stockholm Beginner WorkshopSplunkLive Oslo/Stockholm Beginner Workshop
SplunkLive Oslo/Stockholm Beginner Workshopjenny_splunk
 
Splunk live london_grs
Splunk live london_grsSplunk live london_grs
Splunk live london_grsjenny_splunk
 
Splunk live paris_overview_02_07_2013 v2.1
Splunk live paris_overview_02_07_2013 v2.1Splunk live paris_overview_02_07_2013 v2.1
Splunk live paris_overview_02_07_2013 v2.1jenny_splunk
 
Paris live eddiesatterly_022013
Paris live eddiesatterly_022013Paris live eddiesatterly_022013
Paris live eddiesatterly_022013jenny_splunk
 
Splunk corporate overview German 2012
Splunk corporate overview German 2012Splunk corporate overview German 2012
Splunk corporate overview German 2012jenny_splunk
 

Mais de jenny_splunk (6)

Analytics with splunk - Advanced
Analytics with splunk - AdvancedAnalytics with splunk - Advanced
Analytics with splunk - Advanced
 
SplunkLive Oslo/Stockholm Beginner Workshop
SplunkLive Oslo/Stockholm Beginner WorkshopSplunkLive Oslo/Stockholm Beginner Workshop
SplunkLive Oslo/Stockholm Beginner Workshop
 
Splunk live london_grs
Splunk live london_grsSplunk live london_grs
Splunk live london_grs
 
Splunk live paris_overview_02_07_2013 v2.1
Splunk live paris_overview_02_07_2013 v2.1Splunk live paris_overview_02_07_2013 v2.1
Splunk live paris_overview_02_07_2013 v2.1
 
Paris live eddiesatterly_022013
Paris live eddiesatterly_022013Paris live eddiesatterly_022013
Paris live eddiesatterly_022013
 
Splunk corporate overview German 2012
Splunk corporate overview German 2012Splunk corporate overview German 2012
Splunk corporate overview German 2012
 

Último

From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .Alan Dix
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demoHarshalMandlekar2
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI AgeCprime
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPathCommunity
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality AssuranceInflectra
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterMydbops
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsRavi Sanghani
 
Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Hiroshi SHIBATA
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rick Flair
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...panagenda
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersRaghuram Pandurangan
 

Último (20)

From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .From Family Reminiscence to Scholarly Archive .
From Family Reminiscence to Scholarly Archive .
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demo
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI Age
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
UiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to HeroUiPath Community: Communication Mining from Zero to Hero
UiPath Community: Communication Mining from Zero to Hero
 
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance[Webinar] SpiraTest - Setting New Standards in Quality Assurance
[Webinar] SpiraTest - Setting New Standards in Quality Assurance
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL Router
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and Insights
 
Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024Long journey of Ruby standard library at RubyConf AU 2024
Long journey of Ruby standard library at RubyConf AU 2024
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
Why device, WIFI, and ISP insights are crucial to supporting remote Microsoft...
 
Generative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information DevelopersGenerative AI for Technical Writer or Information Developers
Generative AI for Technical Writer or Information Developers
 

Data Obfuscation in Splunk Enterprise: Anonymization, Pseudonymization and Encryption Techniques

  • 1. Copyright © 2015 Splunk Inc. Data Obfuscation in Splunk Enterprise
  • 2. Agenda The Drivers Data-in-Flight Data-at-Rest Data Obfuscation within Splunk Enterprise – Anonymization – Pseudonymization – Summing Up Demonstration
  • 3. Agenda The Drivers Data-in-Flight Data-at-Rest Data Obfuscation within Splunk Enterprise – Anonymization – Pseudonymization – Summing Up Demonstration
  • 5. The Drivers Collect and Process Data 5 Stakeholder* Workers Council Data Privacy Officer GDPR Privacy Shield PCI …. Requirements* Anonymization Pseudonymization Pseudonymization Encryption RAW Event archival for 1 year – 3 month online *Examples only | Your legal department will assist you.
  • 6. The Drivers Collect and Process Data 6 Stakeholder* Workers Council Data Privacy Officer GDPR Privacy Shield PCI …. Requirements* Anonymization Pseudonymization Pseudonymization Encryption RAW Event archival for 1 year – 3 month online *Examples only | Your legal department will assist you. You need to ensure to have a flexible platform that fits your needs – even if they change!
  • 7. Spoilt for Choice What – Confidentiality / Integrity / Authenticity Where – At Source / In Flight / At Rest / Presentation Layer How – Anonymization / Pseudonymization Usability, Maintainability, Cost, … 7
  • 9. Data-in-Flight Ways to secure your connections to Splunk Enterprise Encryption and/or authentication using your own certificates for: – Communications between the browser and Splunk Web – Communication from Splunk forwarders to indexers – Other types of communication, such as communications between Splunk instances over the management port 9 Type of exchange Client function Server function Encryption Certificate Authentication Common Name checking Type of data exchanged Browser to Splunk Web Browser Splunk Web NOT enabled by default dictated by client (browser) dictated by client (browser) search term results Inter-Splunk communication Splunk Web splunkd enabled by default NOT enabled by default NOT enabled by default search term results Forwarding splunkd as a forwarder splunkd as an indexer NOT enabled by default NOT enabled by default NOT enabled by default data to be indexed Deployment server to indexers splunkd as a forwarder splunkd as an indexer NOT enabled by default NOT enabled by default NOT enabled by default Not recommended. Use Pass4SymmKey instead. http://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwithSSL
  • 11. Data-at-Rest Integrity Ways to ensure the integrity of your machine data stored in Splunk Compute SHA256 hash for every slice in hot bucket When bucket rolls from hot to warm, create SHA256 hash of the file containing the hashes of the individual slices Can verify integrity from the CLI Enable for an entire index 11 http://docs.splunk.com/Documentation/Splunk/latest/Security/Dataintegritycontrol http://blogs.splunk.com/2015/10/28/data-integrity-is-back-baby/
  • 12. Data-at-Rest Encryption Entire data set Encryption of all data Splunk writes to disk (index, raw data, metadata) Pros: – Easy to implement with OS or device means / covers all data / transparent to Splunk Cons: – All indexes on a given file system / performance overhead / limited security against rogue users
  • 13. Data-at-Rest Encryption Transparent Encryption-at-Rest with Vormetrics 13 https://www.vormetric.com/sites/default/files/wp-splunk-vormetric.pdf
  • 15. What is Anonymization? Anonymization of data means processing it with the aim of irreversibly preventing the identification of the individual to whom it relates. 15 2016-12-24 09:00 host1 mm28522 login successful 2016-12-24 09:00 host1 ****** login successful
  • 16. What is Pseudonymization? Pseudonymization of data means replacing any identifying characteristics of data with a pseudonym, or, in other words, a value which does not allow the data subject to be directly identified. 16 2016-12-24 09:00 host1 mm28522 login successful 2016-12-24 09:00 host1 0fc43cd589ec74ddb677501adf6c295b login successful
  • 18. Anonymization At Rest / At Indexing Time / Modify Raw Events SEDCMD or TRANSFORMS props.conf [source::.../accounts.log] SEDCMD-accounts = s/ssn=d{5}(d{4})/ssn=xxxxx1/g [source::.../another.log] TRANSFORMS-anon=ssn-anon transforms.conf [ssn-anon] REGEX=(ssn=)d{5}(d{4}) FORMAT=$1xxxxx$2 DEST_KEY=_raw 18 https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata
  • 19. Anonymization Presentation Layer / At Search Time Locked down User – Pre-defined App with dashboard access only – No search app, no raw search, no raw event drill down | eval username = “******“ 19 https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Anonymizedata
  • 21. Pseudonymization Presentation Layer / At Search Time Locked down User – Pre-defined App with dashboard access only – No search app, no raw search, no raw event drill down | eval username = sha256(username) or use your own custom search command 21 https://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Anonymizedata
  • 22. Pseudonymization At Source / Application Data pseudonymization before Splunk picks it up Pros: – Managed earliest as possible in the process – Data source owner responsible – Data-Privacy challenge solved for data stored on source as well Cons: – Individual solution per data source/type/method required
  • 23. Pseudonymization Event Duplication Into Different Indexes User authorization managed via role based access control for indexes Pros: – Easy to implement and maintain, easy usability, low complexity Cons: – Storage costs (can be limited with tsidx retention but slower search) – License costs idx_cleartext idx_pseudonym
  • 24. Pseudonymization Using Summary Index Scheduled summary search transforms the data and stores it in a new summary index Pros: – Summary index does not count against license – Everything GUI managed – Allows grouped aggregation (anonymization, too) Cons: – Regular search utilizing resources – Breaks out-of-the-box CIM (source=search name, sourcetype=stash, original sourcetype moved to orig_sourcetype) idx_cleartext idx_summary
  • 25. Pseudonymization Modular Input Data de-centralized piped through a custom method using a modular input Pros: – High flexibility on encryption, hashing etc. methods and requirements – Processing can be done decentralized at each forwarder to distribute processing load Cons: – Scripting required for modular inputs
  • 27. Summing Up Many possible ways – each has pros and cons Anonymization – Data aggregation might be an additional layer as specific access to a specific file from a specific host does potentially allow identification back to an individual Pseudonymization – Requires a proper concept to ensure the pros and cons are known and accepted in advance such that impact and additional complexity is understood in production and operation use We are transparent on possibilities, allow multiple ways and levels which are available for data obfuscation. Choose the best and most efficient combination for you!
  • 30. Modular Input Search on Splunkbase https://splunkbase.splunk.com/apps/#/search/Modular%20Input/
  • 31. Protocol Data Inputs Different input protocols Custom data handler allows to pre-process data – Polyglot: many programming languages can be used. E.g. Java, JavaScript, Python, … Different output protocols Data Handler https://splunkbase.splunk.com/app/1901/
  • 32. Demo Scenarios Encryption Modular Input Log file with sensitive data Read log file data File Monitor input (UF) Protocol Data Inputs Data Handler encrypts field values Data sent and stored Decryption Custom Search Command Events in Splunk with encrypted field values User is authorized to use custom search command Custom search command Decrypts fields Anonymization SEDCMD Log file with sensitive data Read log file data File Monitor Input (UF) Pipeline Apply SEDCMD and replace data Data stored 32
  • 33. Log File With Sensitive Data – cleartext.log 33 Field Description Action we want to take first First name Encrypt with AES name Last Name Encrypt with AES dob Date of Birth Encrypt with AES uid Employee ID Anonymize
  • 34. UF File Monitor – Forward Data 34
  • 35. Receiving side – Protocol Data Inputs 35
  • 36. Protocol Data Inputs Configuration – Protocols 36
  • 37. Protocol Data Inputs Configuration – Data Handler 37 Parameters for custom data handler: • regex: identify fields to encrypt • AES_Key_File: Key to use to encrypt PDI Custom data handler (here: Java)
  • 39. Decrypt Data – Custom Search Command 39
  • 41. SEDCMD for Anonymization of uid Field (props.conf) 41
  • 42. Q & A
  • 43. Splunk User Groups EMEA 43 https://usergroups.splunk.com/

Notas do Editor

  1. http://blogs.splunk.com/2014/11/11/protocol-data-inputs/ https://splunkbase.splunk.com/app/1901/