Only auditors, SAs or web administrators may access web server log files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2252	WG250 IIS7	SV-39694r3_rule		Medium

Description
A major tool in exploring the web site use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. To ensure the integrity of the log files and protect the SA and the web manager from a conflict of interest related to the maintenance of these files, only the members of the Auditors group will be granted permissions to move, copy, and delete these files in the course of their duties related to the archiving of these files.

Description

A major tool in exploring the web site use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. To ensure the integrity of the log files and protect the SA and the web manager from a conflict of interest related to the maintenance of these files, only the members of the Auditors group will be granted permissions to move, copy, and delete these files in the course of their duties related to the archiving of these files.

STIG	Date
IIS 7.0 WEB SITE STIG	2017-06-28

Details

Check Text ( C-29362r2_chk )
Query the SA to determine who has update access to the web server log files. The role of auditor and the role of SA should be distinctly separate. An individual functioning as an Auditor should not also serve as an SA due to a conflict of interest. Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer. No other individuals may access log files. If IDs associated with roles other than auditors, administrators (administrators group), or web administrators have any access to log files, this is a finding. If an administrator (or administrators group) or a web administrator has greater than READ authority to log files, this is a finding. This check does not apply to service IDs utilized by automated services necessary to process, manage, and store log files.

Check Text ( C-29362r2_chk )

Query the SA to determine who has update access to the web server log files.

The role of auditor and the role of SA should be distinctly separate. An individual functioning as an Auditor should not also serve as an SA due to a conflict of interest.

Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.

Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer.

No other individuals may access log files.

If IDs associated with roles other than auditors, administrators (administrators group), or web administrators have any access to log files, this is a finding.

If an administrator (or administrators group) or a web administrator has greater than READ authority to log files, this is a finding.

This check does not apply to service IDs utilized by automated services necessary to process, manage, and store log files.

Fix Text (F-27466r2_fix)
Ensure that write or greater authority to web server log files is only granted to auditors. Ensure that only auditors, administrators group or web administrators may read web server log files.