Security auditing must be configured.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Part of OSX00145-Configure security auditing

Associated with IA controls: ECAR-3, ECAR-2, ECAR-1

SV-38521r1_rule Security auditing must be configured.

Vulnerability discussion

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises or attacks that have occurred, has begun, or is about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Without an audit trail providing information as to what occurred and if it was successful or unsuccessful, it is difficult to analyze a series of events to determine the steps used by an attacker to compromise a system or network, or what exactly happened that led to a Denial of Service. Collecting data such as the successful and unsuccessful events is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.

Check content

Open a terminal session and enter the following command view the audit flags. more /etc/security/audit_control file. Review the entries and ensure the line includes the following: flags: lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. If the file does not contain the appropriate flags, this is a finding.

Fix text

Open a terminal session and edit the /etc/security/audit_control file. Find the line beginning with "flags". Replace that line with the following: flags:lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. Save the file.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.