Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-1137 | 1.010 | SV-25128r1_rule | ECTP-1 | Medium |
Description |
---|
The Security Event Log contains information on security exceptions that occur on the system. This data is critical for identifying security vulnerabilities and intrusions. The Application and System logs can also contain information that is critical in assessing security events. Therefore, these logs must be protected from unauthorized access and modification. Only individuals who have auditing responsibilities (e.g, IAOs, IAMs, auditors, etc.) should be members of this group. The individual SAs responsible for maintaining this system can also be members of this group. |
STIG | Date |
---|---|
Windows 7 Security Technical Implementation Guide | 2012-08-22 |
Check Text ( C-7886r1_chk ) |
---|
Interview the SA to determine if an Auditors group for controlling the Windows Event Logs has been created. NOTE: The administrator(s) responsible for the installation and maintenance of the individual system(s) must be a member(s) of the Auditors group. This will permit the responsible administrator to enable and configure system auditing, and perform maintenance functions related to the logs. Administrators who are not responsible for maintenance on an individual system will not be included in the Auditors group. |
Fix Text (F-34r1_fix) |
---|
Create an Auditors group for controlling the Windows Event Logs and assign the necessary rights and access controls. |