The Bromium Enterprise Controller (BEC) must generate a log record that can be sent to the central log server, which will alert the system administrator (SA) and Information System Security Officer (ISSO), at a minimum, when it is unable to connect to the SQL database.

From Bromium Secure Platform 4.x Security Technical Implementation Guide

Associated with: CCI-001858

SV-95159r1_rule The Bromium Enterprise Controller (BEC) must generate a log record that can be sent to the central log server, which will alert the system administrator (SA) and Information System Security Officer (ISSO), at a minimum, when it is unable to connect to the SQL database.

Vulnerability discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected. Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less).Upon loss of connection to the SQL Server, BEC will:1. Immediately create a number of log entries in "default.log" and "worker.log"; 2. Refuse connections from the endpoints, which will result in the endpoints automatically storing local events (for future transfer when the SQL connection is restored); and3. Immediately notify the BEC administrator during logon via the management console interface.

Check content

Ask the site representatives if they have developed and implemented a solution for storing the contents of "default.log" and "worker.log" to receive alerts if SQL Server becomes unavailable. The contents of "default.log" and "worker.log" should be sent to a centralized events server. Check that the agent associated with the event server has been installed on the BEC. If the BEC does not generate an immediate log entry that can be sent to the central log server, which will alert the SA and ISSO, at a minimum, when it is unable to connect to the SQL database, this is a finding.

Fix text

Automatically forward all contents of "default.log" and "worker.log" to the site's central log server in real time. Install the file monitoring agent that is provided by the site's centralized events server (e.g., syslog, SIEM) and configure to monitor and forward "default.log" and "worker.log" (example: C:\Program Data\Bromium\BMS\Logs\default.log). Follow the instructions included with the event log server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.