Title

For devices and hosts within the scope of coverage, the Central Log Server must be configured to automatically aggregate events that indicate account actions. (Cat II impact)

Discussion

If the Central Log Server is configured to filter or remove account log records transmitted by devices and hosts within its scope of coverage, forensic analysis tools will be less effective at detecting and reporting on important attack vectors. A comprehensive account management process must include capturing log records for the creation of user accounts and notification of administrators and/or application owners. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. This requirement addresses the concern that the Central Log Server may be configured to filter out certain levels of information, which may result in the discarding of DoD-required accounting actions addressed in the AC-2 (4) controls such as creation, modification, deletion, and removal of privileged accounts.

Check Content

Examine the configuration. Verify the Central Log Server automatically aggregates events that indicate account actions for each device and host within its scope of coverage. If the Central Log Server is not configured to automatically aggregate events that indicate account actions for each device and host within its scope of coverage, this is a finding.

Fix Text

Configure the Central Log Server to automatically aggregate events that indicate account actions for each device and host within its scope of coverage.

Additional Identifiers

Rule ID: SV-206516r401224_rule

Vulnerability ID: V-206516

Group Title: SRG-APP-000516

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.