Audit logs must be documented and included in backups.

From Email Services Policy STIG

Part of EMG3-006 Audit Logs Included in Backups

Associated with IA controls: ECTB-1

SV-20673r3_rule Audit logs must be documented and included in backups.

Vulnerability discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit logs are essential to the investigation and prosecution of unauthorized access to email services software and data. Unless audit logs are available for review, the extent of data compromise may not be determined and the vulnerability exploited may not be discovered. Undiscovered vulnerabilities could lead to additional or prolonged compromise of the data.Audit records should be backed up not less than weekly on to a different system or media than the system being audited, to ensure preservation of audit history.

Check content

Access the EDSP documentation that describes inclusion of Exchange audit data with the weekly backups. Verify these directories are included in the backup strategy to preserve log history. If email audit records are included in backups, this is not a finding.

Fix text

Include email audit records in backups and document the backup strategy in the EDSP.

Pro Tips

Powered by sagemincer