The application must generate audit records for all direct access to the information system.

From Application Security and Development Security Technical Implementation Guide

Part of SRG-APP-000508

Associated with: CCI-000172

SV-84035r1_rule The application must generate audit records for all direct access to the information system.

Vulnerability discussion

Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.When an application provides direct access to underlying OS features and functions, that access must be audited.Audit records can be generated from various components within the information system (e.g., module or policy filter).

Check content

Review the application documentation and interview the application administrator. Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS. Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website. If the application does not provide direct access to the system, this requirement is not applicable. Access the application logs. Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system. Review the logs and ensure the actions executed were logged. Log information must include the user responsible for executing the action, the action executed, and the result of the action. If the application does not log all direct access to the system, this is a finding.

Fix text

Configure the application to log all direct access to the system.

Pro Tips

Powered by sagemincer