SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28144	SHPT-00-000465	SV-36578r1_rule	ECTP-1	Medium

Description
Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable when performed by an information system which the user being audited has privileged access. The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system where the user in question has limited access or by using storage media that cannot be modified (e.g., write-once recording devices).

Description

Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable when performed by an information system which the user being audited has privileged access. The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system where the user in question has limited access or by using storage media that cannot be modified (e.g., write-once recording devices).

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2011-12-20

Details

Check Text ( C-37393r1_chk )
1. Navigate to “Active Directory Users and Computers” -> Users. 2. Double click on the name of the audit administrators group. 3. Select the “Members of” tab and work with the SA or application administrator to verify the accounts are for authorized audit administrators. 4. Mark as a finding if privileged users who do not have authorized audit responsibilities for SharePoint are listed in this group.

Check Text ( C-37393r1_chk )

1. Navigate to “Active Directory Users and Computers” -> Users.
2. Double click on the name of the audit administrators group.
3. Select the “Members of” tab and work with the SA or application administrator to verify the accounts are for authorized audit administrators.
4. Mark as a finding if privileged users who do not have authorized audit responsibilities for SharePoint are listed in this group.

Fix Text (F-32630r1_fix)
1. Create a SharePoint audit security group in AD or use an existing audit administrators group that has been designated and authorized to perform audit functions. 2. Add the accounts of authorized audit administrators to the group. 3. On the server(s) for which the SharePoint software is installed, navigate to Server Manager -> Local Users and Groups. 4. Select the “Member of” tab and verify that this account is a member of the Administrators group and no other groups.

Fix Text (F-32630r1_fix)

1. Create a SharePoint audit security group in AD or use an existing audit administrators group that has been designated and authorized to perform audit functions.
2. Add the accounts of authorized audit administrators to the group.
3. On the server(s) for which the SharePoint software is installed, navigate to Server Manager -> Local Users and Groups.
4. Select the “Member of” tab and verify that this account is a member of the Administrators group and no other groups.