STIGQter: STIG Summary: Cisco IOS XE Switch NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Cisco switch must be configured to audit the execution of privileged functions.

DISA Rule

SV-220546r531084_rule

Vulnerability Number

V-220546

Group Title

SRG-APP-000343-NDM-000289

Rule Version

CISC-ND-000940

Severity

CAT II

CCI(s)

CCI-002234 - The information system audits the execution of privileged functions.

Weight

Fix Recommendation

Configure the Cisco switch to log all commands entered from the command line interface as well as log all configuration changes as shown in the following example:

SW1(config)#logging userinfo
SW1(config)#archive
SW1(config-archive)#log config
SW1(config-archive-log-cfg)#logging enable
SW1(config-archive-log-cfg)#end

Check Contents

Review the Cisco switch configuration to verify that it is compliant with this requirement. The configuration example below will log all commands entered from the command line interface as well as log all configuration changes.

hostname R1
!
logging userinfo
!
…
…
…
archive
log config
logging enable
!

Note: The logging userinfo global configuration command will generate a log when a user increases his or her privilege level.

If the Cisco switch is not configured to log all commands entered from the command line interface as well as log all configuration changes, this is a finding.

The Cisco switch must be configured to audit the execution of privileged functions.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments