The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69381	APSC-DV-000710	SV-84003r2_rule		Medium

Description
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user is granted access or rights to application features and function not afforded to an ordinary user, they have been granted access to privilege and that action must be logged.

Description

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). When a user is granted access or rights to application features and function not afforded to an ordinary user, they have been granted access to privilege and that action must be logged.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-69795r1_chk )
Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular unprivileged user who is cooperating with the testing. Access and open the auditing logs. Using an account with the appropriate privileges, grant the user a privilege they previously did not have. Attempt to grant privileges in a manner that will cause a failure event such as granting privileges to a non-existent user or attempting to grant privileges with an account that doesn't have the rights to do so. Review the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted. If the application does not log when successful and unsuccessful attempts to grant privilege occur, this is a finding.

Check Text ( C-69795r1_chk )

Review the application documentation and interview the application admin to identify application management interfaces and features.

Access the application management utility and create a test user account or use the account of a regular unprivileged user who is cooperating with the testing.

Access and open the auditing logs.

Using an account with the appropriate privileges, grant the user a privilege they previously did not have.

Attempt to grant privileges in a manner that will cause a failure event such as granting privileges to a non-existent user or attempting to grant privileges with an account that doesn't have the rights to do so.

Review the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted.

If the application does not log when successful and unsuccessful attempts to grant privilege occur, this is a finding.

Fix Text (F-75555r1_fix)
Configure the application to audit successful and unsuccessful attempts to grant privileges.