STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must protect audit tools from unauthorized modification.

DISA Rule

SV-222504r561290_rule

Vulnerability Number

V-222504

Group Title

SRG-APP-000122

Rule Version

APSC-DV-001320

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the application to protect audit tools from unauthorized modifications. Limit users to roles that are assigned the rights to edit or update audit tools and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.

Check Contents

Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.

Identify the application audit tools and their locations.

If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.

Identify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.

Identify the users with the rights to modify the audit tools. This capability will usually be reserved for admin staff.

Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.

File permissions must be configured to limit access to only those users who have been identified and whose access has been approved.

If file permissions are configured so as to allow unapproved modifications to the audit tools, this is a finding.

Vulnerability Number

V-222504

Documentable

False

Rule Version

APSC-DV-001320

Severity Override Guidance

Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools.

Identify the application audit tools and their locations.

If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable.

Identify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs.

Identify the users with the rights to modify the audit tools. This capability will usually be reserved for admin staff.

Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions.

File permissions must be configured to limit access to only those users who have been identified and whose access has been approved.

If file permissions are configured so as to allow unapproved modifications to the audit tools, this is a finding.

Check Content Reference

M

Target Key

4093

Comments