STIGQter STIGQter: STIG Summary: Central Log Server Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 24 Jul 2020:

The Central Log Server must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-95995r1_rule

Vulnerability Number

V-81281

Group Title

SRG-APP-000148-AU-002270

Rule Version

SRG-APP-000148-AU-002270

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

For systems where individual users access, configure and/or manage the system, configure the Central Log Server application so each user is explicitly identified and authenticated. While an authentication server, is often used for logon, this requirement must include instructions for integrating the authentication server so that they system requires unique identification and authentication.

Note: Group accounts are not permitted for logon to the Central Log Server.

Check Contents

Examine the configuration.

Verify that individual user accounts are defined within the application. Each account must have a separate identifier. If an authentication server may be used for login, ensure the application audit logs containing management and configuration actions, identify the individual performing each action.

If the Central Log Server is not configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Vulnerability Number

V-81281

Documentable

False

Rule Version

SRG-APP-000148-AU-002270

Severity Override Guidance

Examine the configuration.

Verify that individual user accounts are defined within the application. Each account must have a separate identifier. If an authentication server may be used for login, ensure the application audit logs containing management and configuration actions, identify the individual performing each action.

If the Central Log Server is not configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Check Content Reference

M

Target Key

3395

Comments