STIGQter: STIG Summary: Cisco IOS Switch NDM Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Cisco switch must be configured to audit the execution of privileged functions.

DISA Rule

SV-220598r521267_rule

Vulnerability Number

V-220598

Group Title

SRG-APP-000343-NDM-000289

Rule Version

CISC-ND-000940

Severity

CAT II

CCI(s)

CCI-002234 - The information system audits the execution of privileged functions.

Weight

Fix Recommendation

Configure the Cisco switch to log all commands entered from the command line interface as well as all configuration changes as shown in the example below:

SW1(config)#logging userinfo
SW1(config)#archive
SW1(config-archive)#log config
SW1(config-archive-log-cfg)#logging enable
SW1(config-archive-log-cfg)#end

Check Contents

Review the Cisco switch configuration to verify that it is compliant with this requirement. The configuration example below will log all commands entered from the command line interface as well as all configuration changes:

hostname R1
!
logging userinfo
!
…
…
…
archive
log config
logging enable
!

Note: The logging userinfo global configuration command will generate a log when a user increases his or her privilege level.

If the Cisco switch is not configured to log all commands entered from the command line interface as well as all configuration changes, this is a finding.

The Cisco switch must be configured to audit the execution of privileged functions.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments