The IDPS must protect information obtained from network scanning from unauthorized access, modification, and deletion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000261-IDPS-000243	SRG-NET-000261-IDPS-000243	SRG-NET-000261-IDPS-000243_rule		Medium

Description

Monitoring outbound traffic enables the network operator to detect an attack towards another network with the local enclave as the base. The intrusion detection device must be configured to ensure non-privilege users are not able to circumvent the detection or alerting mechanisms. In addition, all information collected by the intrusion detection systems must be protected from unauthorized access, modification, and deletion. Train system administrators to never modify or delete portions of the log records that are stored in achieved locations as part of the official records.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43415_chk )
Verify the sensor data collected during network scanning is protected from access by unauthorized system administrator. Verify system administrators, regardless of privileges, cannot modify or delete log entries on the system. If the sensor logs are not protected from unauthorized access, modification, and deletion, this is a finding.

Fix Text (F-43415_fix)
Configure the system to protect sensor event logs from unauthorized access, modification, and deletion while on the sensors or on the management server.