ColdFusion logs must, at a minimum, be transferred simultaneously for interconnected systems and transferred weekly for standalone systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62391	CF11-02-000079	SV-76881r1_rule		Medium

Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. ColdFusion does not offer an automated mechanism to off-load logs, but ColdFusion does have the capability to create archive log files. By using the archive capability, off-loading can be set up using a weekly scheduled task for standalone systems. For interconnected systems, applications such as syslog on Linux can be used to off-load data simultaneously.

Description

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. ColdFusion does not offer an automated mechanism to off-load logs, but ColdFusion does have the capability to create archive log files. By using the archive capability, off-loading can be set up using a weekly scheduled task for standalone systems. For interconnected systems, applications such as syslog on Linux can be used to off-load data simultaneously.

STIG	Date
Adobe ColdFusion 11 Security Technical Implementation Guide	2015-11-02

Details

Check Text ( C-63195r1_chk )
Interview the administrator to determine whether or not ColdFusion logs are transferred to another system weekly for standalone systems and simultaneously for interconnected systems. If the logs are not transferred weekly for standalone systems and simultaneously for interconnected systems, this is a finding.

Fix Text (F-68311r1_fix)
Implement a strategy that transfers logs weekly for standalone systems and simultaneously for interconnected systems.