Title

The Unified Communications Session Manager must be configured to offload session (call) records to a central log server. (Cat I impact)

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This requirement only applies to components where this is specific to the function of the device (e.g., IDPS sensor logs, firewall logs). This does not apply to audit logs generated on behalf of the device itself (management).

Check Content

Verify the Unified Communications Session Manager offloads session records to a central log server. If the Unified Communications Session Manager does not offload session records to a central log server, this is a finding.

Fix Text

Configure the Unified Communications Session Manager to offload session records to a central log server.

Additional Identifiers

Rule ID: SRG-NET-000334-VVSM-00101_rule

Vulnerability ID: SRG-NET-000334-VVSM-00101

Group Title: SRG-NET-000334-VVSM-00101

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.