+AU-09 Protection of Audit Information
---+AU-09(01) Hardware Write-once Media
---+AU-09(02) Store on Separate Physical Systems or Components
---+AU-09(03) Cryptographic Protection
---+AU-09(04) Access by Subset of Privileged Users
---+AU-09(05) Dual Authorization
---+AU-09(06) Read-only Access
---+AU-09(07) Store on Component with Different Operating System
|
AU-09 Protection of Audit Information
Control
- Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
- Alert [Assignement: personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.
Discussion
Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.
Assessment Objective
- audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
- [Assignement: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system audit records
audit tools
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
1. Oversigt
| Titel |
Standard |
|
AU-09(01) Hardware Write-once Media
|
Control
Write audit trails to hardware-enforced, write-once media.
Discussion
Writing audit trails to hardware-enforced, write-once media applies to the initial generation of audit trails (i.e., the collection of audit records that represents the information to be used for detection, analysis, and reporting purposes) and to the backup of those audit trails. Writing audit trails to hardware-enforced, write-once media does not apply to the initial generation of audit records prior to being written to an audit trail. Write-once, read-many (WORM) media includes Compact Disc-Recordable (CD-R), Blu-Ray Disc Recordable (BD-R), and Digital Versatile Disc-Recordable (DVD-R). In contrast, the use of switchable write-protection media, such as tape cartridges, Universal Serial Bus (USB) drives, Compact Disc Re-Writeable (CD-RW), and Digital Versatile Disc-Read Write (DVD-RW) results in write-protected but not write-once media.
Assessment Objective
audit trails are written to hardware-enforced, write-once media.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system hardware settings
system configuration settings and associated documentation
system storage media
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
|
|
AU-09(02) Store on Separate Physical Systems or Components
|
Control
Store audit records [Assignement: frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Discussion
Storing audit records in a repository separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components also preserves the confidentiality and integrity of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or components applies to initial generation as well as backup or long-term storage of audit records.
Assessment Objective
audit records are stored [Assignement: frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system or media storing backups of system audit records
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
|
|
AU-09(03) Cryptographic Protection
|
Control
Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
Discussion
Cryptographic mechanisms used for protecting the integrity of audit information include signed hash functions using asymmetric cryptography. This enables the distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
Assessment Objective
cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system hardware settings
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
|
|
AU-09(04) Access by Subset of Privileged Users
|
Control
Authorize access to management of audit logging functionality to only [Assignement: subset of privileged users or roles].
Discussion
Individuals or roles with privileged access to a system and who are also the subject of an audit by that system may affect the reliability of the audit information by inhibiting audit activities or modifying audit records. Requiring privileged access to be further defined between audit-related privileges and other privileges limits the number of users or roles with audit-related privileges.
Assessment Objective
access to management of audit logging functionality is authorized only to [Assignement: subset of privileged users or roles].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system-generated list of privileged users with access to management of audit functionality
access authorizations
access control list
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
|
AU-09(05) Dual Authorization
|
Control
Enforce dual authorization for [Selection(one-or-more): movement; deletion] of [Assignement: audit information].
Discussion
Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.
Assessment Objective
dual authorization is enforced for the [Selection(one-or-more): movement; deletion] of [Assignement: audit information].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
access authorizations
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
|
AU-09(06) Read-only Access
|
Control
Authorize read-only access to audit information to [Assignement: subset of privileged users or roles].
Discussion
Restricting privileged user or role authorizations to read-only helps to limit the potential damage to organizations that could be initiated by such users or roles, such as deleting audit records to cover up malicious activity.
Assessment Objective
read-only access to audit information is authorized to [Assignement: subset of privileged users or roles].
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system-generated list of privileged users with read-only access to audit information
access authorizations
access control list
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
|
AU-09(07) Store on Component with Different Operating System
|
Control
Store audit information on a component running a different operating system than the system or component being audited.
Discussion
Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.
Assessment Objective
audit information is stored on a component running a different operating system than the system or component being audited.
Assessment Method
Examine
Audit and accountability policy
system security plan
privacy plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records
Interview
Organizational personnel with audit and accountability responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|