Title

ColdFusion logs must, at a minimum, be transferred simultaneously for interconnected systems and transferred weekly for standalone systems. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. ColdFusion does not offer an automated mechanism to off-load logs, but ColdFusion does have the capability to create archive log files. By using the archive capability, off-loading can be set up using a weekly scheduled task for standalone systems. For interconnected systems, applications such as syslog on Linux can be used to off-load data simultaneously.

Check Content

Interview the administrator to determine whether or not ColdFusion logs are transferred to another system weekly for standalone systems and simultaneously for interconnected systems. If the logs are not transferred weekly for standalone systems and simultaneously for interconnected systems, this is a finding.

Fix Text

Implement a strategy that transfers logs weekly for standalone systems and simultaneously for interconnected systems.

Additional Identifiers

Rule ID: SV-237159r641572_rule

Vulnerability ID: V-237159

Group Title: SRG-APP-000515-AS-000203

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.