The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222478	APSC-DV-001030	SV-222478r508029_rule		Medium

Description
Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The additional information required is dependent on the type of information (i.e., sensitivity of the data and the environment within which it resides). At a minimum, the organization must audit either full-text recording of privileged commands or the individual identities of group users, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. In addition, the application must have the capability to include organization-defined additional, more detailed information in the audit records for audit events.

Description

Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. Organizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The additional information required is dependent on the type of information (i.e., sensitivity of the data and the environment within which it resides). At a minimum, the organization must audit either full-text recording of privileged commands or the individual identities of group users, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. In addition, the application must have the capability to include organization-defined additional, more detailed information in the audit records for audit events.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2020-09-30

Details

Check Text ( C-24148r493342_chk )
Review application documentation and interview application administrator. Identify audit log locations and review audit logs. Access the system as a privileged user and execute privileged commands. Review the application logs and ensure that the logs contain all details of the actions performed. If a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands. If an action was performed, such as activating a check box, that action must be logged. Review group account users, review logs to determine if the individual users of group accounts are identified in the logs. If the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.

Check Text ( C-24148r493342_chk )

Review application documentation and interview application administrator. Identify audit log locations and review audit logs.

Access the system as a privileged user and execute privileged commands.

Review the application logs and ensure that the logs contain all details of the actions performed.

If a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands.

If an action was performed, such as activating a check box, that action must be logged.

Review group account users, review logs to determine if the individual users of group accounts are identified in the logs.

If the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.

Fix Text (F-24137r493343_fix)
Configure the application to log the full text recording of privileged commands or the individual identities of group users.