E-mail audit trails must be reviewed daily.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18869	EMG3-037 EMail	SV-20654r1_rule	ECAT-1	Low

Description
Access to E-mail services and software is logged to establish a history of actions taken in the system. Unauthorized access or use of the system could indicate an attempt to bypass established permissions. Reviewing the log history can lead to discovery of unauthorized access attempts. Reviewing the logs daily helps to ensure that prompt attention is given to any suspicious activities discovered therein.

Description

Access to E-mail services and software is logged to establish a history of actions taken in the system. Unauthorized access or use of the system could indicate an attempt to bypass established permissions. Reviewing the log history can lead to discovery of unauthorized access attempts. Reviewing the logs daily helps to ensure that prompt attention is given to any suspicious activities discovered therein.

STIG	Date
Email Services Policy	2012-01-31

Details

Check Text ( C-22677r1_chk )
Interview the IAO. Review the audit trail review procedures in the System Security plan. The procedures should include artifacts of the occurence and frequency of reviews. Also review the evidence of review results. Criteria: If Audit trail review procedures and evidence of reviews exist, this is not a finding.

Fix Text (F-19573r1_fix)
Procedure: Develop and implement procedures to review audit records daily. Include procedures for response to indications of access by unauthorized usage.