STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.

DISA Rule

SV-222478r508029_rule

Vulnerability Number

V-222478

Group Title

SRG-APP-000101

Rule Version

APSC-DV-001030

Severity

CAT II

CCI(s)

• CCI-000135 - The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.

Weight

10

Fix Recommendation

Configure the application to log the full text recording of privileged commands or the individual identities of group users.

Check Contents

Review application documentation and interview application administrator. Identify audit log locations and review audit logs.

Access the system as a privileged user and execute privileged commands.

Review the application logs and ensure that the logs contain all details of the actions performed.

If a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands.

If an action was performed, such as activating a check box, that action must be logged.

Review group account users, review logs to determine if the individual users of group accounts are identified in the logs.

If the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.

Vulnerability Number

V-222478

Documentable

False

Rule Version

APSC-DV-001030

Severity Override Guidance

Review application documentation and interview application administrator. Identify audit log locations and review audit logs.

Access the system as a privileged user and execute privileged commands.

Review the application logs and ensure that the logs contain all details of the actions performed.

If a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands.

If an action was performed, such as activating a check box, that action must be logged.

Review group account users, review logs to determine if the individual users of group accounts are identified in the logs.

If the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.

Check Content Reference

M

Target Key

4093

Comments