The log information from the IIS 8.5 web server must be protected from unauthorized modification.

From IIS 8.5 Server Security Technical Implementation Guide

Associated with: CCI-000163

SV-91389r2_rule The log information from the IIS 8.5 web server must be protected from unauthorized modification.

Vulnerability discussion

A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.

Check content

Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Click the "Logging" icon. Click the "Browse" button and navigate to the directory where the log files are stored. Right-click the log file name to review and click “Properties”. Click the "Security" tab. Verify only authorized groups are listed, if others are listed, this is a finding. If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. If an account with roles other than auditor has greater than read authority to the log files, this is a finding. This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files.

Fix text

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.