SharePoint must protect audit information from unauthorized access to the trace data log files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30282	SHPT-00-000431	SV-39935r2_rule	ECTP-1	Medium

Description
If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult. To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized access. SharePoint is an integrated product with comprehensive built-in auditing capabilities working with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database.

Description

If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult. To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized access. SharePoint is an integrated product with comprehensive built-in auditing capabilities working with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2015-10-02

Details

Check Text ( C-39017r2_chk )
Verify security permissions to log file are to authorized administrators only. 1. In Central Administration, click Monitoring. 2. On the Monitoring page, in the Reporting list, click Configure diagnostic logging. 3. Obtain the Path location for the Trace Log. 4. Navigate to the file location, right-click, and select Properties. View the Security tab. 5. Verify permissions include only the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group.. 6. Mark as a finding if groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group have permission to the log folder.

Check Text ( C-39017r2_chk )

Verify security permissions to log file are to authorized administrators only.
1. In Central Administration, click Monitoring.
2. On the Monitoring page, in the Reporting list, click Configure diagnostic logging.
3. Obtain the Path location for the Trace Log.
4. Navigate to the file location, right-click, and select Properties. View the Security tab.
5. Verify permissions include only the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group..
6. Mark as a finding if groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group have permission to the log folder.

Fix Text (F-34083r3_fix)
Change the directory permissions where trace data logs are stored. 1. In Central Administration, click Monitoring. 2. On the Monitoring page, in the Reporting list, click Configure diagnostic logging. 3. Obtain the Path location for the Trace Log. 4. Navigate to the file location, right-click, and select Properties. View the Security tab. 5. Delete any groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group from the permissions list.

Fix Text (F-34083r3_fix)

Change the directory permissions where trace data logs are stored.
1. In Central Administration, click Monitoring.
2. On the Monitoring page, in the Reporting list, click Configure diagnostic logging.
3. Obtain the Path location for the Trace Log.
4. Navigate to the file location, right-click, and select Properties. View the Security tab.
5. Delete any groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group from the permissions list.