From IIS 8.5 Server Security Technical Implementation Guide
Part of SRG-APP-000118-WSR-000068
Associated with: CCI-000162
A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. To verify the integrity of the log files and protect the SA and the web manager from a conflict of interest related to the maintenance of these files, only the members of the Auditors group will be granted permissions to move, copy, and delete these files in the course of their duties related to the archiving of these files.
Query the SA to determine who has update access to the web server log files. The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest. Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer. No other individuals may access log files. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.
Remove Write permissions from any users other than auditors. Remove Read permissions from any users other than auditors, System Administrators, or Web Administrators. Remove greater than Read permissions from any users other than auditors and SYSTEM.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer