Product Security (Secure Development)
As a software supplier to many of the world’s largest and most security-savvy organizations, Splunk has high standards and high expectations to meet when it comes to product security. To meet and exceed those standards, Splunk follows a rigorous, industry best practice approach to secure software development. Through a continuous process of security testing and review, and the addition of pro-security features and functionality, Splunk endeavors to provide software faster and safer whether to our Cloud or customer premises.
Security by Design
The best way to prevent security defects is by designing a product securely from the ground up. Splunk Product Security engages with development teams during the design and planning stages of the development lifecycle to make recommendations and push teams towards secure design patterns. Activities performed at these stages include:
Security Assurance
Once functional and security requirements are established, we perform a manual and automated validation activities designed to secure our products, including such things as:
Responsible Disclosure Standards
Splunk follows industry best practices to discover and remediate vulnerabilities before release, and post-release addresses vulnerabilities reported by third parties using a risk based approach, which may include the following activities:
- Promptly evaluating potential security vulnerabilities
- Rating and prioritizing confirmed vulnerabilities using Common Vulnerability Scoring System (CVSS)
- Assigning CVEs to disclosed security vulnerabilities
- Making reasonable efforts to issue releases to mitigate or fix vulnerabilities in supported versions
- Expediting maintenance releases for affected, supported versions for critical-risk, high-impact vulnerabilities
- Notifying customers of vulnerabilities at the Splunk Product Security page and through the Splunk Product Security Announcements RSS feed
- Resolving vulnerabilities may require upgrading to a new Major or Minor release
