SharePoint must protect audit information from unauthorized modification of usage and health data collection logs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28089	SHPT-00-000435	SV-36597r1_rule	ECTP-1	Medium

Description
If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized modification. SharePoint is an integrated product with comprehensive built-in auditing capabilities working with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database. Only designated audit administrators and internal accounts should have any type of permission to these files.

Description

If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized modification. SharePoint is an integrated product with comprehensive built-in auditing capabilities working with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database. Only designated audit administrators and internal accounts should have any type of permission to these files.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2011-12-20

Details

Check Text ( C-37359r1_chk )
Verify security permissions to log file are to authorized administrators only. 1. Log on to SharePoint Central Administration. 2. Click on “Monitoring”. 3. Click on “Configure usage and health data collection”. 4. Obtain the Directory Location for the usage logs. 5. Navigate to the file location, Right click, and select "Properties". View the Security tab. 6. Verify that permissions include only the local Administrators group and SYSTEM group. 7. Mark as a finding if groups or users other than the local Administrators group and SYSTEM group have permission to the log file.

Check Text ( C-37359r1_chk )

Verify security permissions to log file are to authorized administrators only.
1. Log on to SharePoint Central Administration.
2. Click on “Monitoring”.
3. Click on “Configure usage and health data collection”.
4. Obtain the Directory Location for the usage logs.
5. Navigate to the file location, Right click, and select "Properties". View the Security tab.
6. Verify that permissions include only the local Administrators group and SYSTEM group.
7. Mark as a finding if groups or users other than the local Administrators group and SYSTEM group have permission to the log file.

Fix Text (F-32596r1_fix)
Check the directory permissions where usage data collection is stored. 1. Log on to SharePoint Central Administration. 2. Click on “Monitoring”. 3. Click on “Configure usage and health data collection”. 4. Obtain the Directory Location for the usage logs. 5. Navigate to the file location, Right click, and select "Properties". View the Security tab. 6. Delete any groups or users other than the local Administrators group and SYSTEM group from the permissions list.

Fix Text (F-32596r1_fix)

Check the directory permissions where usage data collection is stored.
1. Log on to SharePoint Central Administration.
2. Click on “Monitoring”.
3. Click on “Configure usage and health data collection”.
4. Obtain the Directory Location for the usage logs.
5. Navigate to the file location, Right click, and select "Properties". View the Security tab.
6. Delete any groups or users other than the local Administrators group and SYSTEM group from the permissions list.