Signing our security audit records
Audit logs can be signed to ensure the integrity of our audit data. By signing our audit records, modifications of the audit logs can be traced.
Restriction: Signing audit data is only available for data created using the default audit service provider. If we are using the SMF emitter or a 3rd party emitter we will not be able to sign the data. Before configuring our security audit records to be signed, enable global security and security auditing in the environment. We must be assigned the auditor role and the administrator role to configure audit record signing.
Tasks
- Click Security > Security Auditing > Audit record signing configuration.
- Select the Enable signing check box to specify that our audit records should be signed. All other fields on this panel will be unavailable until this check box has been selected.
- Select the keystore containing the signing certificate from the Managed keystore containing the signing certificate dropdown menu.
- If we are using an existing certificate to sign our audit records, ensure Certificate in keystore is selected and specify the intended certificate in the Certificate alias dropdown menu.
- If we are generating a new certificate to sign our audit records, select Create a new certificate in the selected keystore and follow these steps:
- Enter the name of our new certificate in the Certificate alias field.
- Select on of the following options: Import the encryption certificate, Automatically generate certificate or Import a certificate. The certificate used to encrypt the data in the audit log files can either be created or imported.
- If we selected Import the encryption certificate, then we will use the encryption certificate to also sign our audit records. Skip to the last step on this page to complete this configuration.
- If we selected to generate a certificate, then skip to the last step on this page to complete this configuration.
- If we selected to import a certificate from an existing keystore, then continue on with step c.
- Enter the name of the keystore file in the Key file name field.
- Enter the path to the keystore file in the Path field.
- Select the keystore type from the Type dropdown list. The default value of the Type dropdown list is PKCS12.
- Enter the password associated with the keystore in the Key File password field.
- Click Get key file aliases to populate the Certificate alias to import dropdown menu.
- Select the certificate to be imported from the Certificate alias to import dropdown menu.
- Click OK.
After we have completed these steps, our audit logs will be digitally signed to ensure the integrity of the data.
What to do next
After we have finished configuring the audit logs to be signed, we can ensure the confidentiality of our audit logs by configuring the audit subsystem to encrypt our audit records.
Protecting our security audit data Encrypting security audit data using scripting Signing security audit data using scripting Audit encryption keystores and certificates collection Audit record encryption configuration settings Audit record signing configuration settings Audit record keystore settings