SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges.

From MS SharePoint 2010 Security Technical Implementation Guide

Part of SRG-APP-000127-COL-000097

Associated with: CCI-001351

SV-36578r2_rule SharePoint must support the requirement that privileged access is further defined between audit-related privileges and other privileges.

Vulnerability discussion

Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. Auditing might not be reliable when performed by an information system which the user being audited has privileged access. The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus, limiting the users with audit-related privileges. Reducing the risk of audit compromises by privileged users can also be achieved by performing audit activity on a separate information system where the user in question has limited access or by using storage media that cannot be modified (e.g., write-once recording devices).

Check content

1. Navigate to “Active Directory Users and Computers” -> Users. 2. Double click on the name of the audit administrators group. 3. View the properties of each group and work with the SA or application administrator to verify the accounts are for authorized audit administrators. 4. Mark as a finding if privileged users who do not have authorized audit responsibilities for SharePoint are listed in this group.

Fix text

1. Create a SharePoint audit security group in AD or use an existing audit administrators group that has been designated and authorized to perform audit functions. 2. Add the accounts of authorized audit administrators to the group. 3. On the server(s) for which the SharePoint software is installed, navigate to Server Manager -> Local Users and Groups. 4. View the properties of each group and verify that this account is a member of the Administrators group and no other groups.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer