Title

The VPN Gateway must produce log records containing information to establish the outcome of the events. (Cat II impact)

Discussion

Without information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the network. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the network after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.

Check Content

Examine the log configuration on the VPN Gateway or view several alert events on the organization's central audit server. Alternatively, examine the Central Log Server to see if it contains information about success or failure of client connection attempts or other events. If the traffic log entries do not include the success or failure of connection attempts and other events, this is a finding.

Fix Text

Configure the VPN Gateway to generate log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the client connection attempts.

Additional Identifiers

Rule ID: SV-207200r608988_rule

Vulnerability ID: V-207200

Group Title: SRG-NET-000091

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.