The mobile operating system must produce audit records containing sufficient information to establish the identity of any user or subject associated with the event.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-33266	SRG-OS-000255-MOS-000128	SV-43685r1_rule		Medium

Description
Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Without sufficient information establishing what type of audit events occurred, investigation into the severity of events is severely hindered. As defined in RFC 5424 "The Syslog Protocol", event severity levels allow system administrators and IA personnel to more easily identify critical system issues.

Description

Operating system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Without sufficient information establishing what type of audit events occurred, investigation into the severity of events is severely hindered. As defined in RFC 5424 "The Syslog Protocol", event severity levels allow system administrators and IA personnel to more easily identify critical system issues.

STIG	Date
Mobile Operating System Security Requirements Guide	2012-10-01

Details

Check Text ( C-41563r1_chk )
Examine the mobile operating system configuration for producing audit records containing sufficient information to establish the identity of any user or subject associated with the event. If the audit records do not contain sufficient information to establish identity, this is a finding.

Fix Text (F-37196r1_fix)
Configure the mobile operating system to produce audit records containing sufficient information to establish the identity of any user or subject associated with the event.