STIGQter: STIG Summary: Microsoft IIS 8.5 Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.

DISA Rule

SV-214405r508658_rule

Vulnerability Number

V-214405

Group Title

SRG-APP-000120-WSR-000070

Rule Version

IISW-SV-000115

Severity

CAT II

CCI(s)

• CCI-000162 - The information system protects audit information from unauthorized access.
• CCI-000163 - The information system protects audit information from unauthorized modification.
• CCI-000164 - The information system protects audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Open the IIS 8.5 Manager.

Click the IIS 8.5 web server name.

Click the "Logging" icon.

Click the "Browse" button and navigate to the directory where the log files are stored.

Right-click the log file name to review and click “Properties”.

Click the "Security" tab.

Set the log file permissions for the appropriate group(s).

Click "OK".

Select "Apply" in the "Actions" pane.

Check Contents

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

Open the IIS 8.5 Manager.
Click the IIS 8.5 web server name.
Click the "Logging" icon.
Click the "Browse" button and navigate to the directory where the log files are stored.
Right-click the log file name to review.
Click “Properties”.
Click the “Security” tab.

Verify log file access is restricted as follows.

SYSTEM - Full Control
Administrators - Full Control

If log access is not restriced as listed above, this is a finding.

Vulnerability Number

V-214405

Documentable

False

Rule Version

IISW-SV-000115

Severity Override Guidance

This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

Open the IIS 8.5 Manager.
Click the IIS 8.5 web server name.
Click the "Logging" icon.
Click the "Browse" button and navigate to the directory where the log files are stored.
Right-click the log file name to review.
Click “Properties”.
Click the “Security” tab.

Verify log file access is restricted as follows.

SYSTEM - Full Control
Administrators - Full Control

If log access is not restriced as listed above, this is a finding.

Check Content Reference

M

Target Key

4000

Comments