The network device must provide audit record generation capability for organizationally defined auditable events occurring within the network device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000113-NDM-000073	SRG-NET-000113-NDM-000073	SRG-NET-000113-NDM-000073_rule		Low

Description
Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network device. Many events are mandated by other controls; however, organizations must also define additional events for logging based on mission requirements.

Description

Auditing and logging are key components of any security architecture. It is essential for security personnel to know what is being done, what attempted to be done, where it was done, when it was done, and by whom in order to compile an accurate risk assessment. Logging the actions of specific events provides a means to investigate an attack, recognize resource utilization or capacity thresholds, or to simply identify an improperly configured network device. Many events are mandated by other controls; however, organizations must also define additional events for logging based on mission requirements.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000113-NDM-000073_chk )
Obtain a list of organizationally defined events which should be logged. Search for a sampling of these events in the audit log entries. If the network device audit log records do not show audit events for the organizationally defined events, this is a finding.

Fix Text (F-SRG-NET-000113-NDM-000073_fix)
Create a list of organizationally defined audit events which should be logged. Configure the network device to log the required events.