Audit logs must be included in weekly backups.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-18880	EMG3-006 E-mail	SV-20673r1_rule	ECTB-1	Medium

Description
Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit logs are essential to the investigation and prosecution of unauthorized access to E-Mail services software and data. Unless audit logs are available for review, the extent of data compromise may not be determined and the vulnerability exploited may not be discovered. Undiscovered vulnerabilities could lead to additional or prolonged compromise of the data. Audit records should be backed up not less than weekly on to a different system or media than the system being audited, to ensure preservation of audit history.

Description

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit logs are essential to the investigation and prosecution of unauthorized access to E-Mail services software and data. Unless audit logs are available for review, the extent of data compromise may not be determined and the vulnerability exploited may not be discovered. Undiscovered vulnerabilities could lead to additional or prolonged compromise of the data. Audit records should be backed up not less than weekly on to a different system or media than the system being audited, to ensure preservation of audit history.

STIG	Date
Email Services Policy	2012-01-31

Details

Check Text ( C-22682r1_chk )
Interview the E-mail Administrator or the IAO. Access documentation that describes inclusion of Exchange audit data with the weekly backups. Verify that this directory is included in backup strategy to preserve log history. Criteria: If E-Mail services audit records are backed up at least weekly on to a different system or media, this is not a finding.

Fix Text (F-19577r1_fix)
Ensure that E-Mail services audit records are backed up at least weekly on to a different system or media.