STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must initiate session auditing upon startup.

DISA Rule

SV-222468r508029_rule

Vulnerability Number

V-222468

Group Title

SRG-APP-000092

Rule Version

APSC-DV-000910

Severity

CAT II

CCI(s)

• CCI-001464 - The information system initiates session audits at system start-up.

Weight

10

Fix Recommendation

Configure the application to begin logging application events as soon as the application starts up.

Check Contents

Examine the application design documentation and interview the application administrator to identify application logging behavior.

If the application is writing to an existing log or log file:

Open and monitor the application log.

Start the application service and view the log entries.

Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application writes events to a new log on startup:

Identify location logs are written to, start the application and then identify and access the new log.

Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application does not begin logging events upon start up, this is a finding.

Vulnerability Number

V-222468

Documentable

False

Rule Version

APSC-DV-000910

Severity Override Guidance

Examine the application design documentation and interview the application administrator to identify application logging behavior.

If the application is writing to an existing log or log file:

Open and monitor the application log.

Start the application service and view the log entries.

Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application writes events to a new log on startup:

Identify location logs are written to, start the application and then identify and access the new log.

Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events.

If the application does not begin logging events upon start up, this is a finding.

Check Content Reference

M

Target Key

4093

Comments