The web server must capture, record, and log all content related to a user session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-41609	SRG-APP-000093-WSR-000053	SV-54186r3_rule		Medium

Description
A user session to a web server is in the context of a user accessing a hosted application that extends to any plug-ins/modules and services that may execute on behalf of the user. The web server must be capable of enabling a setting for troubleshooting, debugging, or forensic gathering purposes which will log all user session information related to the hosted application session. Without the capability to capture, record, and log all content related to a user session, investigations into suspicious user activity would be hampered.

Description

A user session to a web server is in the context of a user accessing a hosted application that extends to any plug-ins/modules and services that may execute on behalf of the user. The web server must be capable of enabling a setting for troubleshooting, debugging, or forensic gathering purposes which will log all user session information related to the hosted application session. Without the capability to capture, record, and log all content related to a user session, investigations into suspicious user activity would be hampered.

STIG	Date
Web Server Security Requirements Guide	2015-08-28

Details

Check Text ( C-48038r2_chk )
Review the web server documentation and deployed configuration to determine if the web server captures and logs all content related to a user session. Request a user access the hosted applications and verify the complete session is logged. If any of the session is excluded from the log, this is a finding.

Fix Text (F-47068r2_fix)
Configure the web server to capture and log all content related to a user session.