SV-222503r561242_rule
V-222503
SRG-APP-000121
APSC-DV-001310
CAT II
10
Configure the application to protect audit data from unauthorized access. Limit users to roles that are assigned the rights to view, edit or copy audit data, and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and audit tools.
Identify the application audit tools and their locations.
If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.
Identify the methods used for implementing the audit tool functionality within the application. Typical methods are file system-based, e.g., a separate executable file that when invoked provides audit functionality, an application user interface to an audit module, or a combination thereof.
For file system access: Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.
Permissions must be configured to limit access to only those who have been identified and whose access has been approved.
If file permissions are configured to allow unapproved access, this is a finding.
For circumstances where audit tools are accessed via application sub-modules or menus: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account.
If a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.
V-222503
False
APSC-DV-001310
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and audit tools.
Identify the application audit tools and their locations.
If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.
Identify the methods used for implementing the audit tool functionality within the application. Typical methods are file system-based, e.g., a separate executable file that when invoked provides audit functionality, an application user interface to an audit module, or a combination thereof.
For file system access: Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.
Permissions must be configured to limit access to only those who have been identified and whose access has been approved.
If file permissions are configured to allow unapproved access, this is a finding.
For circumstances where audit tools are accessed via application sub-modules or menus: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account.
If a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.
M
4093