STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

DISA Rule

SV-251191r960882_rule

Vulnerability Number

V-251191

Group Title

SRG-APP-000090-DB-000065

Rule Version

RD6X-00-001500

Severity

CAT II

CCI(s)

• CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.

Weight

10

Fix Recommendation

Configure the DBMS's settings to allow designated personnel to select which auditable events are audited. This can be done on Redis Enterprise with ACLs and RBAC.

To configure RBAC:
1. Log in to the Redis Control Plane as an admin user.
2. Navigate to the access control tab.
3. Provide the appropriate permissions and privileges as defined by the organization.

Check Contents

Auditing alerts can be selected on Redis Enterprise. With the RBAC settings, by default, only the Admin group can configure these events in the database. Additional roles with admin privileges can also be configured.

To view which roles have admin level privileges:
1. Log in to Redis Enterprise.
2. Navigate to the Access control tab and review the users listed therein.

To view which alerts are configured:
1. Log in to Redis Enterprise.
2. Navigate to the Databases tab.
3. Select any database to view and select the configuration tab.
4. Scroll down to determine which Alerts are selected to be emailed to the appropriate audiences (if any).

If designated personnel are not able to configure auditable events, this is a finding.

Vulnerability Number

V-251191

Documentable

False

Rule Version

RD6X-00-001500

Severity Override Guidance

Auditing alerts can be selected on Redis Enterprise. With the RBAC settings, by default, only the Admin group can configure these events in the database. Additional roles with admin privileges can also be configured.

To view which roles have admin level privileges:
1. Log in to Redis Enterprise.
2. Navigate to the Access control tab and review the users listed therein.

To view which alerts are configured:
1. Log in to Redis Enterprise.
2. Navigate to the Databases tab.
3. Select any database to view and select the configuration tab.
4. Scroll down to determine which Alerts are selected to be emailed to the appropriate audiences (if any).

If designated personnel are not able to configure auditable events, this is a finding.

Check Content Reference

M

Target Key

5443