STIGQter: STIG Summary: IBM WebSphere Traditional V9.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Aug 2018:

The WebSphere Application Server must generate log records when successful/unsuccessful attempts to access subject privileges occur.

DISA Rule

SV-95951r1_rule

Vulnerability Number

V-81237

Group Title

SRG-APP-000091-AS-000052

Rule Version

WBSP-AS-000380

Severity

CAT III

CCI(s)

• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Weight

10

Fix Recommendation

In the administrative console, navigate to Security >> Security auditing >> Audit Service Provider.

Click on the providers in the list.

Note the names of all the filters, e.g., "DefaultAuditSpecification_1".

Go back to Security >> Security auditing >> Event type Filters.

Find the filters previously noted.

If you do not see that the provider filter for SECURITY_AUTHN, SECURITY_AUTHZ, SECURITY_AUTHN_TERMINATE, and ADMIN_REPOSITORY_SAVE that has INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING defined, click the "New" button to create a new filter.

Give it a unique name.

Select "SECURITY_AUTHN" and "ADMIN_REPOSITORY_SAVE" from the "Events to associate with audit filter" field.

Click the right arrow to fill in "Enabled events" field.

From "Event outcomes to associate with an audit filter" field, select INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING.

Click the right arrow to fill in "Enabled event outcomes" field.

Click "OK".

Go back to Security >> Security auditing >> Audit Service Provider >> [provider].

Under "Selectable filters", select the new filter just created.

Click the right arrow to add it to the list.

Click "OK".

Click "Save".

Restart the DMGR and all the JVMs.

Check Contents

In the administrative console, navigate to Security >> Security auditing >> Audit Service Provider.

Click on the providers in the list.

Note: names of all the filters, e.g., "DefaultAuditSpecification_1".

Go back to Security >> Security auditing >> Event type Filters.

Find the filters previously noted.

If you do not see the filter for SECURITY_AUTHN, SECURITY_AUTHZ, SECURITY_AUTHN_TERMINATE, and ADMIN_REPOSITORY_SAVE that has INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING defined, this is a finding.

Vulnerability Number

V-81237

Documentable

False

Rule Version

WBSP-AS-000380

Severity Override Guidance

In the administrative console, navigate to Security >> Security auditing >> Audit Service Provider.

Click on the providers in the list.

Note: names of all the filters, e.g., "DefaultAuditSpecification_1".

Go back to Security >> Security auditing >> Event type Filters.

Find the filters previously noted.

If you do not see the filter for SECURITY_AUTHN, SECURITY_AUTHZ, SECURITY_AUTHN_TERMINATE, and ADMIN_REPOSITORY_SAVE that has INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING defined, this is a finding.

Check Content Reference

M

Target Key

3399

Comments