The application must log destination IP addresses.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69423	APSC-DV-000950	SV-84045r1_rule		Medium

Description
The IP addresses of the systems that the application connects to are an important aspect of identifying application network related activity. Recording the IP addresses of the system the application connects to in the application logs provides forensic evidence and aids in investigating and correlating the sources of malicious behavior related to security events. Logging this information can be particularly useful for Service-Oriented Applications where there is application to application connectivity.

Description

The IP addresses of the systems that the application connects to are an important aspect of identifying application network related activity. Recording the IP addresses of the system the application connects to in the application logs provides forensic evidence and aids in investigating and correlating the sources of malicious behavior related to security events. Logging this information can be particularly useful for Service-Oriented Applications where there is application to application connectivity.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-03-20

Details

Check Text ( C-69841r1_chk )
If the application design documentation indicates the application does not initiate connections to remote systems this requirement is not applicable. Network connections to systems used for support services such as DNS, AD, or LDAP may be stored in the system logs. These connections are applicable. Identify log source based upon application architecture, design documents and input from application admin. Review and monitor the application or system logs. Connect to the application and utilize the application functionality that initiates connections to a destination system. If the application routinely connects to remote system on a regular basis you may simply allow the application to operate in the background while the logs are observed. Observe the log activity and determine if the log includes an entry to indicate the IP address of the destination system. If the IP address of the remote system is not recorded along with the event in the event log, this is a finding.

Check Text ( C-69841r1_chk )

If the application design documentation indicates the application does not initiate connections to remote systems this requirement is not applicable.

Network connections to systems used for support services such as DNS, AD, or LDAP may be stored in the system logs. These connections are applicable.

Identify log source based upon application architecture, design documents and input from application admin.

Review and monitor the application or system logs.

Connect to the application and utilize the application functionality that initiates connections to a destination system.

If the application routinely connects to remote system on a regular basis you may simply allow the application to operate in the background while the logs are observed.

Observe the log activity and determine if the log includes an entry to indicate the IP address of the destination system.

If the IP address of the remote system is not recorded along with the event in the event log, this is a finding.

Fix Text (F-75599r1_fix)
Configure the application to record the destination IP address of the remote system.