Title

The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion. (Cat II impact)

Discussion

A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

Check Content

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review. Click “Properties”. Click the “Security” tab. Verify log file access is restricted as follows. SYSTEM - Full Control Administrators - Full Control If log access is not restriced as listed above, this is a finding.

Fix Text

Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane.

Additional Identifiers

Rule ID: SV-214405r879578_rule

Vulnerability ID: V-214405

Group Title: SRG-APP-000120-WSR-000070

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.