Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The log information from the IIS 8.5 web server must be protected from unauthorized deletion.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-76695 | IISW-SV-000115 | SV-91391r1_rule | Medium |
| Description |
|---|
| A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity. |
| STIG | Date |
|---|---|
| IIS 8.5 Server Security Technical Implementation Guide | 2018-01-03 |
Details
| Check Text ( C-76351r1_chk ) |
|---|
| Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click Properties. Click the "Security" tab. Verify only authorized groups are listed, if others are listed, this is a finding. Note: The log file should be restricted as follows: Administrators, SYSTEM, TrustedInstaller, Auditors group: Full |
| Fix Text (F-83391r1_fix) |
|---|
| Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane. |