Title

The web server must generate information to be used by external applications or entities to monitor and control remote access. (Cat II impact)

Discussion

Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions. By providing remote access information to an external monitoring system, the organization can monitor for cyber attacks and monitor compliance with remote access policies. The organization can also look at data organization wide and determine an attack or anomaly is occurring on the organization which might not be noticed if the data were kept local to the web server. Examples of external applications used to monitor or control access would be audit log monitoring systems, dynamic firewalls, or infrastructure monitoring systems.

Check Content

Review the web server documentation and configuration to determine if the web server is configured to generate information for external applications monitoring remote access. If a mechanism is not in place providing information to an external application used to monitor and control access, this is a finding.

Fix Text

Configure the web server to provide remote connection information to external monitoring and access control applications.

Additional Identifiers

Rule ID: SV-206354r960765_rule

Vulnerability ID: V-206354

Group Title: SRG-APP-000016

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.