STIGQter: STIG Summary: ISEC7 Sphere Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The ISEC7 EMM Suite must back up audit records at least every seven days onto a different system or system component than the system or component being audited, provide centralized management and configuration of the content to be captured in audit records generated by all ISEC7 EMM Suite components, and off-load audit records onto a different system or media than the system being audited.

DISA Rule

SV-224766r505933_rule

Vulnerability Number

V-224766

Group Title

SRG-APP-000125

Rule Version

ISEC-06-000500

Severity

CAT II

CCI(s)

• CCI-001348 - The information system backs up audit records on an organization-defined frequency onto a different system or system component than the system or component being audited.
• CCI-001844 - The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.
• CCI-001851 - The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Weight

10

Fix Recommendation

Log in to the ISEC7 EMM Console.

Navigate to Administration >> Configuration >> Apache Tomcat Settings.

Set the log directory path to the desired location.

On the ISEC7 EMM Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM Suite.
Select the conf folder.
Open config.properties and set the logPath to the desired location of the log server.

Check Contents

Open the central log repository and verify the ISEC7 logs have been written to the location of the log server.

Alternatively:

Log in to the ISEC7 EMM Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify that the log directory path is set to the desired location.

On the ISEC7 EMM Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM Suite.
Select the conf folder.
Open config.properties and verify the logPath is set to the desired location.

If ISEC7 EMM logs are not written to an audit log management server, this is a finding.

Vulnerability Number

V-224766

Documentable

False

Rule Version

ISEC-06-000500

Severity Override Guidance

Open the central log repository and verify the ISEC7 logs have been written to the location of the log server.

Alternatively:

Log in to the ISEC7 EMM Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify that the log directory path is set to the desired location.

On the ISEC7 EMM Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM Suite.
Select the conf folder.
Open config.properties and verify the logPath is set to the desired location.

If ISEC7 EMM logs are not written to an audit log management server, this is a finding.

Check Content Reference

M

Target Key

4200

Comments