The IDPS must protect audit tools from unauthorized modification.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000102-IDPS-000102	SRG-NET-000102-IDPS-000102	SRG-NET-000102-IDPS-000102_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. It is imperative the auditing tools are secured and can only be accessed by authorized personnel.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. It is imperative the auditing tools are secured and can only be accessed by authorized personnel.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43232_chk )
View the configuration for the applications audit tools. Verify permission to modify audit tools is configured for the audit group members only. If administrators who are not audit administrators have permission to modify the audit tools, this is a finding.

Fix Text (F-43232_fix)
Configure the management console so only members of the audit administrators group have permission to modify the audit tools.