The log information from the IIS 8.5 website must be protected from unauthorized modification or deletion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76795	IISW-SI-000213	SV-91491r4_rule		Medium

Description
A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

STIG	Date
IIS 8.5 Site Security Technical Implementation Guide	2019-10-01

Details

Check Text ( C-76451r4_chk )
Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the “Security” tab. Verify only authorized groups are listed, if others are listed, this is a finding. Note: The log file should be restricted as follows: Auditors - Full Control SYSTEM - Full Control Administrators - Full Control Web Managers - Read

Check Text ( C-76451r4_chk )

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.
Click the site name.
Click the "Logging" icon.
Click "Browse" and navigate to the directory where the log files are stored.
Right-click the log file name to review and click “Properties”.
Click the “Security” tab.
Verify only authorized groups are listed, if others are listed, this is a finding.

Note: The log file should be restricted as follows:
Auditors - Full Control
SYSTEM - Full Control
Administrators - Full Control
Web Managers - Read

Fix Text (F-83491r1_fix)
Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the “Security” tab. Set the log file permissions for the appropriate group.