STIGQter: STIG Summary: Samsung SDS EMM v1.5.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Jan 2017:

The Samsung SDS EMM server must be configured to transfer MD audit logs and Samsung SDS EMM server logs to another server for analysis and reporting.

DISA Rule

SV-87857r1_rule

Vulnerability Number

V-73205

Group Title

PP-MDM-201129

Rule Version

SEMM-15-000320

Severity

CAT II

CCI(s)

• CCI-000169 - The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components.
• CCI-000366 - The organization implements the security configuration settings.
• CCI-001571 - The organization defines the information system auditable events.

Weight

10

Fix Recommendation

The following describes how the MDM server can transfer MD audit logs and MDM server logs to another server for analysis and reporting. This is a manual process that has to be performed by the administrator periodically.

To transfer Samsung SDS EMM server logs, on the MDM console, do the following:
1) Log in to the Samsung SDS EMM Server Admin Console using a web browser.
2) Go to Service Overview >> Logs >> Audit Logs.
3) Choose a date and click the "Export" button to export the selected Audit data to a file on the administrator’s workstation.
4) Follow the browser-specific instructions to save the comma-separated values file.

To transfer MD audit logs, on the MDM console, do the following:
1) Log in to the Samsung SDS EMM Server Admin Console using a web browser.
2) Go to Service Overview >> Logs >> Device Logs.
3) Choose the desired device in the left side of the “Device Logs” screen.
4) Choose the Export action in the row for the device log to be saved to export the selected MD audit log to a file on the administrator’s workstation.
5) Follow the browser-specific instructions to save the comma-separated values file.

Check Contents

The following describes how the MDM server transfers MD audit logs and MDM server logs to another server for analysis and reporting.

Ask the system administrator to identify which audit management server Samsung SDS EMM server logs are transferred to. Verify that the audit management server contains records of the MD audit logs and MDM server logs, which have been transferred from the Samsung SDS EMM server. If logs are not automatically transferred periodically, verify logs are transferred manually at least daily.

If the Samsung SDS EMM server is not configured to transfer MD audit logs to another server (automatically or manually), this is a finding.

Vulnerability Number

V-73205

Documentable

False

Rule Version

SEMM-15-000320

Severity Override Guidance

The following describes how the MDM server transfers MD audit logs and MDM server logs to another server for analysis and reporting.

Ask the system administrator to identify which audit management server Samsung SDS EMM server logs are transferred to. Verify that the audit management server contains records of the MD audit logs and MDM server logs, which have been transferred from the Samsung SDS EMM server. If logs are not automatically transferred periodically, verify logs are transferred manually at least daily.

If the Samsung SDS EMM server is not configured to transfer MD audit logs to another server (automatically or manually), this is a finding.

Check Content Reference

M

Target Key

3175

Comments