The IDPS must monitor for unusual usage of administrative user accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34475	SRG-NET-000013-IDPS-00013	SV-45238r1_rule		Low

Description
Atypical account usage is behavior that is not part of normal usage cycles (e.g., large amounts of user account activity occurring after hours or on weekends). A comprehensive account management process will ensure an audit trail, which documents the use of application user accounts and as required, notifies administrators and/or application owners, exists. Such a process greatly reduces the risk that compromised user accounts will continue to be used by unauthorized persons and provides logging that can be used for forensic purposes. Security for the operating system or authentication server accounts is beyond the scope of this security guide. This requirement applies to accounts created and managed on or by the IDPS components.

Description

Atypical account usage is behavior that is not part of normal usage cycles (e.g., large amounts of user account activity occurring after hours or on weekends). A comprehensive account management process will ensure an audit trail, which documents the use of application user accounts and as required, notifies administrators and/or application owners, exists. Such a process greatly reduces the risk that compromised user accounts will continue to be used by unauthorized persons and provides logging that can be used for forensic purposes. Security for the operating system or authentication server accounts is beyond the scope of this security guide. This requirement applies to accounts created and managed on or by the IDPS components.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-42587r1_chk )
Review the IDPS audit configuration to determine if an audit log entry is generated that includes account usage information. If the IDPS audit configuration parameters are set to log values outside of normal usage, as determined by the configuration management plan, this is a finding.

Fix Text (F-38634r1_fix)
Configure the IDPS management console/server to monitor for irregular usage of IDPS administrative user accounts.