Title

Symantec ProxySG must use a centralized log server. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).

Check Content

Determine whether audit log off-loading is configured. 1. Log on to the Web Management Console. 2. Browse to Configuration >> Access Logging >> Logs. 3. Click "Upload Client" and Verify that a "Client type" is specified. All client types use TCP for communication to the target server (FTP/S, HTTP/S, Kafka, etc.). If Symantec ProxySG does not use a centralized log server, this is a finding.

Fix Text

Configure audit log off-loading. 1. Log on to the Web Management Console. 2. Browse to Configuration >> Access Logging >> Logs. 3. Configure the "Upload Client" and "Upload Schedule" capabilities. (All client types use TCP for communication to the site's event server.)

Additional Identifiers

Rule ID: SV-104211r1_rule

Vulnerability ID: V-94257

Group Title: SRG-NET-000334-ALG-000050

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.