The IIS 8.5 web server log files must only be accessible by privileged users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76691	IISW-SV-000113	SV-91387r3_rule		Medium

Description
A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. To verify the integrity of the log files and protect the SA and the web manager from a conflict of interest related to the maintenance of these files, only the members of the Auditors group will be granted permissions to move, copy, and delete these files in the course of their duties related to the archiving of these files.

Description

A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. To verify the integrity of the log files and protect the SA and the web manager from a conflict of interest related to the maintenance of these files, only the members of the Auditors group will be granted permissions to move, copy, and delete these files in the course of their duties related to the archiving of these files.

STIG	Date
IIS 8.5 Server Security Technical Implementation Guide	2018-04-05

Details

Check Text ( C-76347r3_chk )
Query the SA to determine who has update access to the web server log files. The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest. Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer. No other individuals may access log files. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

Check Text ( C-76347r3_chk )

Query the SA to determine who has update access to the web server log files.

The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest.

Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit.

Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer.

No other individuals may access log files.

If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding.

If an account with roles other than auditor has greater than read authority to the log files, this is a finding.

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

Fix Text (F-83387r2_fix)
Remove Write permissions from any users other than auditors. Remove Read permissions from any users other than auditors, System Administrators, or Web Administrators. Remove greater than Read permissions from any users other than auditors and SYSTEM.