Title

The Central Log Server must be configured to send an immediate alert to the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost. (Cat III impact)

Discussion

If the system were to continue processing after audit failure, actions could be taken on the system that could not be tracked and recorded for later forensic analysis. To perform this function, some type of heartbeat configuration with all of the devices and hosts must be configured. Because of the importance of ensuring mission/business continuity, organizations may determine that the nature of the audit failure is not so severe that it warrants a complete shutdown of the application supporting the core organizational missions/business operations. In those instances, partial application shutdowns or operating in a degraded mode may be viable alternatives. This requirement applies to each audit data storage repository (i.e., distinct information system component where log records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.

Check Content

Examine the configuration. Verify the system is configured to send an immediate alert to the SA or ISSO if communication with the host and devices within its scope of coverage is lost. If the Central Log Server is not configured to send an immediate alert to the SA or ISSO if communication with the host and devices within its scope of coverage is lost, this is a finding.

Fix Text

Configure the Central Log Server to send an immediate alert to the SA or ISSO if communication with the host and devices within its scope of coverage is lost.

Additional Identifiers

Rule ID: SV-206494r855301_rule

Vulnerability ID: V-206494

Group Title: SRG-APP-000361

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.