Title

The Unified Communications Endpoint must, at a minimum, offload interconnected systems in real-time and offload standalone systems weekly. (Cat II impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. Audit records are commonly produced by session management and border elements. Many Unified Communications Endpoints are not capable of providing audit records and instead rely on session management and border elements. Unified Communications Endpoints capable of producing audit records provide supplemental confirmation of monitored events. Unified Communications Endpoints that support audit records must support offloading.

Check Content

Verify the Unified Communications Endpoint offloads audit records in real time or weekly. If the Unified Communications Endpoint does not offload audit records in real time or weekly, this is a finding.

Fix Text

Configure the Unified Communications Endpoint to offload audit records in real time or weekly.

Additional Identifiers

Rule ID: SRG-NET-000511-VVEP-00010_rule

Vulnerability ID: SRG-NET-000511-VVEP-00010

Group Title: SRG-NET-000511-VVEP-00010

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.