STIGQter: STIG Summary: Bromium Secure Platform 4.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 May 2018:

The Bromium Enterprise Controller (BEC) must generate a log record that can be sent to the central log server, which will alert the system administrator (SA) and Information System Security Officer (ISSO), at a minimum, when it is unable to connect to the SQL database.

DISA Rule

SV-95159r1_rule

Vulnerability Number

V-80455

Group Title

SRG-APP-000360

Rule Version

BROM-00-000785

Severity

CAT II

CCI(s)

• CCI-001858 - The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

Automatically forward all contents of "default.log" and "worker.log" to the site's central log server in real time.

Install the file monitoring agent that is provided by the site's centralized events server (e.g., syslog, SIEM) and configure to monitor and forward "default.log" and "worker.log" (example: C:\Program Data\Bromium\BMS\Logs\default.log). Follow the instructions included with the event log server.

Check Contents

Ask the site representatives if they have developed and implemented a solution for storing the contents of "default.log" and "worker.log" to receive alerts if SQL Server becomes unavailable.

The contents of "default.log" and "worker.log" should be sent to a centralized events server. Check that the agent associated with the event server has been installed on the BEC.

If the BEC does not generate an immediate log entry that can be sent to the central log server, which will alert the SA and ISSO, at a minimum, when it is unable to connect to the SQL database, this is a finding.

Vulnerability Number

V-80455

Documentable

False

Rule Version

BROM-00-000785

Severity Override Guidance

Ask the site representatives if they have developed and implemented a solution for storing the contents of "default.log" and "worker.log" to receive alerts if SQL Server becomes unavailable.

The contents of "default.log" and "worker.log" should be sent to a centralized events server. Check that the agent associated with the event server has been installed on the BEC.

If the BEC does not generate an immediate log entry that can be sent to the central log server, which will alert the SA and ISSO, at a minimum, when it is unable to connect to the SQL database, this is a finding.

Check Content Reference

M

Target Key

3375

Comments