The firewall implementation must log non-local maintenance and diagnostic sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000173-FW-000107	SRG-NET-000173-FW-000107	SRG-NET-000173-FW-000107_rule		Low

Description
This requirement pertains to the use of privileged access when establishing a diagnostic session connecting non-locally (i.e., from the network or using an auxiliary port) to perform session on the servers and network elements. If events associated with non-local administrative access or diagnostic sessions are not logged, a major tool for assessing and investigating attacks would not be available.

Description

This requirement pertains to the use of privileged access when establishing a diagnostic session connecting non-locally (i.e., from the network or using an auxiliary port) to perform session on the servers and network elements. If events associated with non-local administrative access or diagnostic sessions are not logged, a major tool for assessing and investigating attacks would not be available.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000173-FW-000107_chk )
Verify all sessions initiated using the GUI or SSH are logged in either the site's centralized audit log or the firewall audit log. Examine the events in the audit log to see if diagnostic and maintenance sessions are annotated with a separate event code. If non-local maintenance and diagnostic sessions are not captured in the firewall audit logs, this is a finding.

Fix Text (F-SRG-NET-000173-FW-000107_fix)
Configure the auditable events to capture all non-local sessions. Configure the auditable events to capture diagnostic and maintenance sessions.