How to encrypt IIS log files?

glenimp617 · 5 Nov 2019 at 09:09

We have a requirement come in to encrypt the log files on our IIS server.

Does anyone have any ideas how I go about this? I assume there's either a setting to do this, or is it a case of having to copy them somewhere and then encrypt?

Help!

glenimp617 · 5 Nov 2019 at 09:49

rhysduck said:
I don't believe there is such a setting in IIS / Windows to do that. Encrypted partition is probably the best.

Can I ask why you require to encrypt your iis logs?

I think it all started from a GDPR meeting. We do hold personal data coming in from a website we host.

What's some good software to encrypt partitions?

glenimp617 · 5 Nov 2019 at 09:55

snips86x said:
Bitlocker would be the easiest I think

The web server is a VM on Hyper-V. Would that cause any issues?

glenimp617 · 5 Nov 2019 at 10:10

skyripper said:
What is your actual requirement? What are you protecting against and from whom?

An encrypted partition in Windows is going to give you protection only against someone getting to the disks who isnt an authorised admin. Any authorised admin will effectively see the IIS logs in plain text.

If you need to protect the contents of the logfiles (which is counter-productive to troubleshooting and normal admin!) then you need some form of logshipping to a secure server or service, or an automated way to encrypt all the logfiles as they are finished with.

Would it be easier to simply not record all that personal information in the logfiles?

You raise a good point, anyone who hacks the server will still be able to see the data won't they.

Mmmmmm, I'll ask what they are actually wanting to do and why. I think basically it's one of those, we read it online that we need to do it, so do it

glenimp617 · 5 Nov 2019 at 10:27

It's GDPR. any personally identifiable information (including IP addresses) must be encrypted.

The company GDPR officer hasn't a clue. Looking online, there is a lot of talk about it, but no concrete guidance.

If we stopped logging IP addresses, there's not much point in having them at all.

https://www.optimizesmart.com/ask-these-eight-questions-to-make-your-server-logs-gdpr-compliant/

glenimp617 · 5 Nov 2019 at 15:00

LizardKing said:
Do you need to log ip's? i suspect having a retention of a day should be fine (gdpr is more risk based than a list of rules), otherwise you need to ship them off to a syslog server that can meet the requrments.

Possibly not to be honest. I guess we only need it when troubleshooting (maybe)