In the event that communication with the centralized events server is lost, the firewall must continue to queue traffic log records locally.

From Firewall Security Requirements Guide Requirements

Part of SRG-NET-000089-FW-000019

Associated with: CCI-000140

SRG-NET-000089-FW-000019_rule In the event that communication with the centralized events server is lost, the firewall must continue to queue traffic log records locally.

Vulnerability discussion

It is critical that when the network element is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. Responses to audit failure depend on the nature of the failure mode.In accordance with DoD policy, the traffic log must be sent to a centralized events server. When logging functions are lost, system processing cannot be shut down because firewall availability is an overriding concern given the role of the firewall in the enterprise. The system should either be configured to log events to an alternative server or queue log records locally. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local log data with the collection server.Since the events log server uses User Datagram Protocol (UDP) communications, a method for detecting a lost connection must be implemented.

Check content

Verify logging has been enabled and configured for local queuing of the traffic log. If a local log file (or files) is not configured to capture events locally if communication with the centralized events server is lost, this is a finding.

Fix text

Configure local backup events files to capture DoD-defined auditable events either consistently or, if possible, in the event communication with the centralized server is lost.

Pro Tips

Powered by sagemincer