UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The network device must protect the audit records of non-local accesses to privileged accounts and the execution of privileged functions.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000286-NDM-000189 SRG-NET-000286-NDM-000189 SRG-NET-000286-NDM-000189_rule Medium
Description
Auditing may not be reliable when performed by the network device to which the user being audited has privileged access. The privileged user may inhibit auditing or modify audit records. This control enhancement helps mitigate this risk by requiring that privileged access be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system or by using storage media that cannot be modified (e.g., write-once recording devices).
STIG Date
Network Device Management Security Requirements Guide 2013-07-30

Details

Check Text ( C-SRG-NET-000286-NDM-000189_chk )
Review the network device account configuration files to determine if the privileged functions to access and modify audit settings and files are restricted to authorized security personnel.
Review locations of audit logs generated as a result of non-local accesses to privileged accounts and the execution of privileged functions.
Verify there are appropriate controls and permissions to protect the audit information from unauthorized access.

If the audit records which are generated upon non-local access to privileged accounts or upon the execution of privileged functions are not protected, this is a finding.
Fix Text (F-SRG-NET-000286-NDM-000189_fix)
Configure the system to protect the audit records of non-local accesses to privileged accounts and the execution of privileged functions.