The application server must use cryptographic mechanisms to protect the integrity of the application server audit tools.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35445	SRG-APP-000290-AS-000174	SV-46732r1_rule		Medium

Description
Protecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated or replaced. An example is a checksum hash of the file or files. Application server audit tools must use cryptographic mechanisms to protect the integrity of the tools or allow cryptographic protection mechanisms to be applied to their tools.

Description

Protecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. It is not uncommon for attackers to replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs. To address this risk, audit tools must be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated or replaced. An example is a checksum hash of the file or files. Application server audit tools must use cryptographic mechanisms to protect the integrity of the tools or allow cryptographic protection mechanisms to be applied to their tools.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43799r1_chk )
Review the AS configuration to determine if the AS uses cryptographic mechanisms to protect the integrity of audit tools. If the AS does not use cryptographic mechanisms to protect the integrity of audit tools, this is a finding.

Fix Text (F-39989r1_fix)
Configure the AS to use cryptographic mechanisms to protect the integrity of audit tools.