The firewall implementation must produce log records containing sufficient information to establish the source of the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000077-FW-000050	SRG-NET-000077-FW-000050	SRG-NET-000077-FW-000050_rule		Medium

Description
It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Associating event types with detected events in the logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured firewall. Without this capability, it would be difficult to establish, correlate, and investigate the events related to an outage or attack. Please note the distinction between logging and auditing; they are not the same, but they are closely related; auditing is a part of logging. Logging is recording data about events that take place in a system, while auditing is the use of log records to identify security relevant information such as system or user accesses. In short, log records are audited to establish an accurate history. Without logging, it would be impossible to establish an audit trail. Log records must provide the originating IP address (loopback or management interface), process or facility, node or device name, and account (if available) as accurately as possible. Additionally, for log messages generated as a result of an ACL/rule match, the firewall implementation must identify the specific ACL/rule entry that generated the log message. Since log records for an ACL match include source and destination IP addresses of the traffic, this further identifies the source of the suspicious or unauthorized traffic.

Description

It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done in order to compile an accurate risk assessment. Associating event types with detected events in the logs provides a means of investigating an attack, recognizing resource utilization or capacity thresholds, or identifying an improperly configured firewall. Without this capability, it would be difficult to establish, correlate, and investigate the events related to an outage or attack. Please note the distinction between logging and auditing; they are not the same, but they are closely related; auditing is a part of logging. Logging is recording data about events that take place in a system, while auditing is the use of log records to identify security relevant information such as system or user accesses. In short, log records are audited to establish an accurate history. Without logging, it would be impossible to establish an audit trail. Log records must provide the originating IP address (loopback or management interface), process or facility, node or device name, and account (if available) as accurately as possible. Additionally, for log messages generated as a result of an ACL/rule match, the firewall implementation must identify the specific ACL/rule entry that generated the log message. Since log records for an ACL match include source and destination IP addresses of the traffic, this further identifies the source of the suspicious or unauthorized traffic.

STIG	Date
Firewall Security Requirements Guide	2014-07-07

Details

Check Text ( C-SRG-NET-000077-FW-000050_chk )
Examine the log configuration on the firewall implementation, or view several alert records on the organization's central audit log server or the device. Check that each message includes the reporting device IP address (loopback or management interface), process or facility, node or device name, and account (if available). For log messages generated as a result of an ACL/rule match, verify that the specific ACL/rule entry that generated the log message is identified or stated. If the log event records do not include this information, this is a finding.

Check Text ( C-SRG-NET-000077-FW-000050_chk )

Examine the log configuration on the firewall implementation, or view several alert records on the organization's central audit log server or the device. Check that each message includes the reporting device IP address (loopback or management interface), process or facility, node or device name, and account (if available). For log messages generated as a result of an ACL/rule match, verify that the specific ACL/rule entry that generated the log message is identified or stated. If the log event records do not include this information, this is a finding.

Fix Text (F-SRG-NET-000077-FW-000050_fix)
Configure the firewall implementation to include the reporting device IP address (loopback or management interface), process or facility, node or device name, and account (if available). For log messages generated as a result of an ACL/rule match, configure the firewall implementation to identify or state the specific ACL/rule entry that generated the log message.