The log information from the IIS 10.0 web server must be protected from unauthorized modification or deletion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-100115	IIST-SV-000115	SV-109219r1_rule		Medium

Description
A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity. Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069

Description

A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity. Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069

STIG	Date
Microsoft IIS 10.0 Server Security Technical Implementation Guide	2020-06-08

Details

Check Text ( C-98967r1_chk )
This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review. Click "Properties". Click the "Security" tab. Verify log file access is restricted as follows. Otherwise, this is a finding. SYSTEM - Full Control Administrators - Full Control

Check Text ( C-98967r1_chk )

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Click the "Logging" icon.
Click "Browse" and navigate to the directory where the log files are stored.
Right-click the log file name to review.
Click "Properties".
Click the "Security" tab.
Verify log file access is restricted as follows. Otherwise, this is a finding.
SYSTEM - Full Control
Administrators - Full Control

Fix Text (F-105801r1_fix)
Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review and click "Properties". Click the "Security" tab. Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane.