The IDPS must protect information obtained from network monitoring from unauthorized access, modification, and deletion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34776	SRG-NET-000261-IDPS-00187	SV-45700r1_rule		Medium

Description

Monitoring outbound traffic enables the network operator to detect an attack towards another network with the local enclave as the base. The intrusion detection device must be configured to ensure non-privileged users are not able to circumvent the detection or alerting mechanisms. In addition, all information collected by the intrusion detection systems must be protected from unauthorized access, modification, and deletion. Train system administrators to never modify or delete portions of the log records that are stored in achieve locations as part of the official records.

STIG	Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide	2012-11-19

Details

Check Text ( C-43066r1_chk )
Verify the sensor data collected during network monitoring is protected from access by unauthorized system administrators. Verify system administrators, regardless of privileges, cannot modify or delete log entries on the system. If the sensor logs are not protected from unauthorized access, modification, and deletion, this is a finding.

Fix Text (F-39098r1_fix)
Configure the system to protect sensor event logs from unauthorized access, modification, and deletion while on the sensors or on the management server.