Encrypting the security audit records
Audit logs can be encrypted to ensure the audit data is protected. By encrypting the audit records, only users with access to the encrypting certificate will be able to view the audit logs.
Restriction: Encrypting audit data is only available for data created using the default audit service provider. If using the SMF emitter or a 3rd party emitter you will not be able to encrypt the data. Before configuring the security audit records to be encrypted, enable global security and security auditing in the environment. You must be assigned the auditor role to encrypt the security auditing records. If we are using a certificate stored in security.xml, you also require the administrator role to complete this task.
- Click Security > Security Auditing > Audit record encryption configuration .
- Select the Enable encryption check box to specify that the audit records should be encrypted. All other fields on this panel will be unavailable until this check box has been selected.
- Select the keystore that contains the encrypting certificate from the dropdown menu or click New to create a new certificate in an existing keystore. Use the following steps if we are creating a new certificate:
- Enter the name of the keystore in the Name field.
- Enter the path to the keystore file in the Path field.
- Enter the password to be associated with the keystore in the field.
- Confirm the password associated with the keystore by retyping the password in the Confirm password field.
- Select the keystore type from the Type dropdown list.
The default value of the Type dropdown list is PKCS12.
- For an existing certificate to encrypt the audit records, ensure Certificate in keystore is selected and specify the intended certificate in the Certificate alias dropdown menu.
- If generating a new certificate to encrypt the audit records, select Create a new certificate in the selected keystore and follow these steps:
- Enter the name of the new certificate in the Certificate alias field.
- Select either Automatically generate certificate or Import a certificate. The certificate used to encrypt the data in the audit log files can either be created or imported. If we selected to generate a certificate, then skip to the last step on this page. If we selected to import a certificate, then continue on with step c.
- Enter the name of the keystore file in the Key file name field.
- Enter the path to the keystore file in the Path field.
- Select the keystore type from the Type dropdown list.
The default value of the Type dropdown list is PKCS12.
- Enter the password associated with the keystore in the Key File password field.
- Click Get key file aliases to populate the Certificate alias to import dropdown menu.
- Select the certificate to be imported from the Certificate alias to import dropdown menu.
- Click OK.
Results
After completing these steps, the audit logs will be encrypted to ensure only authorized users can view the content of the audit log files.
Next steps
After we have finished configuring the audit logs to be encrypted, we can ensure the data integrity of the audit logs by configuring the audit subsystem to sign the audit records.
Related tasks
Encrypting security audit data using scripting
Signing security audit data using scripting
Protecting the security audit data
Related
Audit encryption keystores and certificates collection
Audit record encryption settings
Audit record signing settings
Audit record keystore settings