The log information from the IIS 8.5 website must be protected from unauthorized deletion.

From IIS 8.5 Site Security Technical Implementation Guide

Associated with: CCI-000164

SV-91491r1_rule The log information from the IIS 8.5 website must be protected from unauthorized deletion.

Vulnerability discussion

A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

Check content

Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the “Security” tab; verify only authorized groups are listed, if others are listed, this is a finding. Note: The log file should be restricted as follows: SYSTEM, Auditors group: Full

Fix text

Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name. Click the "Logging" icon. Click "Browse" and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the “Security” tab. Set the log file permissions for the appropriate group.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.