The IDPS must be configured to stop generating log records or overwrite the oldest log records when an audit failure occurs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000089-IDPS-000093	SRG-NET-000089-IDPS-000093	SRG-NET-000089-IDPS-000093_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. To preserve recent audit information, if an audit failure occurs, the IDPS must either stop producing audit records to overwrite or purge the oldest records.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. To preserve recent audit information, if an audit failure occurs, the IDPS must either stop producing audit records to overwrite or purge the oldest records.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43221_chk )
Verify the management console and sensors are set to stop generating log records or overwrite the oldest log records when an audit failure occurs. If the system is not configured to stop generating log records or overwrite the oldest log records when an audit failure occurs, this is a finding.

Fix Text (F-43221_fix)
Configure the logging server and sensors to stop generating log records or overwrite the oldest log records when an audit failure occurs.