This issue has been solved.

Archive Encryption and Digital Signature

Created: 30 Aug 2012 | Updated: 10 Sep 2012
novajon's picture
Login to vote
0 0 Votes

Hello,

Couple questions about event archives in SSIM 4.7.4

 

1) Are event archives encrypted? What about in FIPS mode, does it do anything to encrypt the events in the archive?

2) Events in SSIM are broken up in 2 hr chunks or when they hit a size limit. Each chunk is compresed and digitally signed. The question is when the signing occurs.

  2a) Does it happen each time an event is added?

  2b) Or Does it happen once the chunk is "closed"? Or on some regular interval?

3) Is each event in SSIM digitally signed? Or is it on a per chunk basis, or per archive basis?

 

Thanks in advance

Quick Look Solution

Good questions :)   1) Event

Good questions :)

 

1) Event are not encrypted but digital signed

2) When the event file is still opened to add more, it is not signed. the signature occurs when the event service close the file.

3) It is signed per file on disk as this is a flat file structure.

Filed Under

Comments

Laurent_c's picture
Laurent_c
Symantec Employee
Accredited
31
Aug
2012
Votes
0
SOLUTION

Good questions :)   1) Event

Good questions :)

 

1) Event are not encrypted but digital signed

2) When the event file is still opened to add more, it is not signed. the signature occurs when the event service close the file.

3) It is signed per file on disk as this is a flat file structure.

novajon's picture
novajon
Partner
Accredited
10
Sep
2012
Votes
0

Perfect thanks! The data is

Perfect thanks! The data is un-readable in each archive file though right? So, even though it's not encrypted, it's stored in a non-readable format?