SharePoint must protect audit information from unauthorized access to the usage and health logs.

From SharePoint 2010 Security Technical Implementation Guide (STIG)

Part of SRG-APP-000118-COL-000090

Associated with IA controls: ECTP-1

Associated with: CCI-000162

SV-36596r2_rule SharePoint must protect audit information from unauthorized access to the usage and health logs.

Vulnerability discussion

If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult. To ensure the veracity of audit data the information system and/or SharePoint must protect audit information from unauthorized access.SharePoint is an integrated product with comprehensive built-in auditing capabilities working with the Windows system event log. Additional trace logs and usage logs are created by the application and are placed in a designated folder. Logs of actions taken by users of site content (editing, modifying, viewing, deleting, etc.) are stored in a SQL database.

Check content

Verify security permissions to log file are to authorized administrators only. 1. In Central Administration, click Monitoring. 2. On the Monitoring page, in the Reporting list, click Configure usage and health data collection. 3. Obtain the log file location for the Usage Data Collection Settings. 4. Navigate to the file location, right-click, and select Properties. View the Security tab. 5. Verify permissions include only the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group. 6. Mark as a finding if groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group, and SYSTEM group have permission to the log folder.

Fix text

Change permissions to the directory where usage data collection is stored: 1. In Central Administration, click Monitoring. 2. On the Monitoring page, in the Reporting list, click Configure usage and health data collection. 3. Obtain the Log file location for the Usage Data Collection Settings. 4. Navigate to the file location, right-click, and select Properties. View the Security tab. 5. Delete any groups or users other than the LOCAL SERVICE, WSS_ADMIN_WPG, WSS_RESTRICTED_WPG_V4, WSS_WPG, local Administrators group and SYSTEM group from the permissions list.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer