Title

SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges. (Cat II impact)

Discussion

Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable when performed by an information system which the user being audited has privileged access. The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system where the user in question has limited access or by using storage media that cannot be modified (e.g., write-once recording devices).

Check Content

1. Navigate to “Active Directory Users and Computers” -> Users. 2. Double click on the name of the audit administrators group. 3. View the properties of each group and work with the SA or application administrator to verify the accounts are for authorized audit administrators. 4. Mark as a finding if privileged users who do not have authorized audit responsibilities for SharePoint are listed in this group.

Fix Text

1. Create a SharePoint audit security group in AD or use an existing audit administrators group that has been designated and authorized to perform audit functions. 2. Add the accounts of authorized audit administrators to the group. 3. On the server(s) for which the SharePoint software is installed, navigate to Server Manager -> Local Users and Groups. 4. View the properties of each group and verify that this account is a member of the Administrators group and no other groups.

Additional Identifiers

Rule ID: SV-36578r2_rule

Vulnerability ID: V-28144

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.