The IDPS must use internal system clocks to generate timestamps for audit records.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000096-IDPS-000099	SRG-NET-000096-IDPS-000099	SRG-NET-000096-IDPS-000099_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. In order to correlate, timestamps are needed on all of the log records.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. In order to determine what is happening within the network infrastructure or to resolve and trace an attack, it is imperative to correlate the log data from multiple the IDPS to acquire a clear understanding as to what happened or is happening. In order to correlate, timestamps are needed on all of the log records.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43229_chk )
Inspect each sensor. Verify the sensors are configured to use the internal system clock to generate the date/timestamp included with the event log entry. If the system is not configured to use internal system clocks to generate timestamps for audit records, this is a finding.

Fix Text (F-43229_fix)
For each sensor, configure the device to use the internal system clock to generate the date/timestamp included with the event log entry.