The Cassandra Server must generate audit records for all privileged activities or other system-level access.
From vRealize - Cassandra Security Technical Implementation Guide
Part of SRG-APP-000504-DB-000354
Associated with:
CCI-000172
SV-87351r1_rule
The Cassandra Server must generate audit records for all privileged activities or other system-level access.
Vulnerability discussion
Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. System documentation should include a definition of the functionality considered privileged.A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to:CREATEALTERDROPGRANTREVOKEDENYThere may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include:TRUNCATE TABLE;DELETE, orDELETE affecting more than n rows, for some n, orDELETE without a WHERE clause;UPDATE orUPDATE affecting more than n rows, for some n, orUPDATE without a WHERE clause;any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal.Depending on the capabilities of the DBMS and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these.Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.
Check content
Review the Cassandra Server configuration to ensure audit records are generated for all privileged activities or other system-level access.
At the command prompt, execute the following command:
# grep '
Fix text
Configure the Cassandra Server to generate audit records for all privileged activities or other system-level access.
At the command line execute the following command:
# sed -i 's/^\(\s*\)\(\s*\)$/\1\2/' /usr/lib/vmware-vcops/user/conf/cassandra/logback.xml
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer