The MDM server must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36343	SRG-APP-100-MDM-282-SRV	SV-47747r1_rule		High

Description
MDM server auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. MDM server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.

Description

MDM server auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. MDM server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44586r1_chk )
Review the MDM server configuration to determine whether the MDM server produces audit records containing sufficient information to establish the identity of any user/subject associated with the event. Have an administrator log into the server and make several security relevant configuration changes and verify these were recorded in the audit log. If the MDM server does not produce audit records containing sufficient information to establish the identity of any user/subject associated with the event, this is a finding.

Check Text ( C-44586r1_chk )

Review the MDM server configuration to determine whether the MDM server produces audit records containing sufficient information to establish the identity of any user/subject associated with the event. Have an administrator log into the server and make several security relevant configuration changes and verify these were recorded in the audit log. If the MDM server does not produce audit records containing sufficient information to establish the identity of any user/subject associated with the event, this is a finding.

Fix Text (F-40876r1_fix)
Configure the MDM server to produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.