Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- MON-09_A01 the content of audit records needed to support monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity is defined.
Defined parameters: successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes
Assessment rigor: 1
Origin: 171A_3.3.1[b] 171A_3.3.2[a] 53A_R5_AU-02_ODP[01] 53A_R5_AU-02_ODP[02] 53A_R5_AU-02a. 53A_R5_AU-02c.[01] - MON-09_A02 audit records contain information that establishes what type of event occurred.
Assessment rigor: 1
Origin: 53A_R5_AU-03a. 53A_R5_AU-02c.[02] - MON-09_A03 audit records contain information that establishes when the event occurred.
Assessment rigor: 1
Origin: 53A_R5_AU-03b. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.02 - MON-09_A04 audit records contain information that establishes where the event occurred.
Assessment rigor: 1
Origin: 53A_R5_AU-03c. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.03 - MON-09_A05 audit records contain information that establishes the source of the event.
Assessment rigor: 1
Origin: 53A_R5_AU-03d. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.04 - MON-09_A06 audit records contain information that establishes the outcome of the event.
Assessment rigor: 1
Origin: 53A_R5_AU-03e. 53A_R5_AU-02c.[02] 171A_R3_A.03.03.02.a.05 - MON-09_A07 audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.
Assessment rigor: 1
Origin: 53A_R5_AU-03f. 171A_R3_A.03.03.02.a.06 - MON-09_A08 event logs needed (e.g., event types to be logged) to enable the monitoring, analysis, investigation and reporting of unlawful or unauthorized system activity are specified.
Assessment rigor: 2
Origin: 171A_3.3.1[a] - MON-09_A09 a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents.
Assessment rigor: 3
Origin: 53A_R5_AU-02d. - MON-09_A10 audit records, once created, contain the defined content.
Assessment rigor: 2
Origin: 171A_3.3.1[d] 171A_3.3.2[b] - MON-09_A11 the frequency of event types selected for logging are reviewed / updated.
Defined parameters: at least weekly
Assessment rigor: 3
Origin: 53A_R5_AU-02_ODP[04] - MON-09_A12 event types selected for logging within the system are defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.03.01.ODP[01] - MON-09_A13 the following event types are specified for logging within the system: <A.03.03.01.ODP[01]: event types>.
Defined parameters: SDP values: at a minimum and where applicable: (1) Authentication events: (a) Logons (Success/Failure) (b) Logoffs (Success) (2) Security Relevant File and Objects events: (a) Create (Success/Failure) (b) Access (Success/Failure) (c) Delete (Success/Failure) (d) Modify (Success/Failure) (e) Permission Modification (Success/Failure) (f) Ownership Modification (Success/Failure) (3) Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure) (4) Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure) (5) User and Group Management events: (a) User add, delete, modify, disable, lock (Success/Failure) (b) Group/Role add, delete, modify (Success/Failure) 6) Use of Privileged/Special Rights events: (a) Security or audit policy changes (Success/Failure) (b) Configuration changes (Success/Failure) (7) Admin or root-level access (Success/Failure) (8) Privilege/Role escalation (Success/Failure) (9) Audit and security relevant log data accesses (Success/Failure) (10) System reboot, restart, and shutdown (Success/Failure) (11) Print to a device (Success/Failure) (12) Print to a file (e.g., pdf format) (Success/Failure) (13) Application (e.g., Adobe, Firefox, MS Office Suite) initialization (Success/Failure) For additional guidance, see: OMB21-31 ML 1
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.03.01.a - MON-09_A14 the event types selected for logging are updated <A.03.03.01.ODP[02]: frequency>.
Defined parameters: at least every 12 months and after any significant incidents or significant changes to risks
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.03.01.b[02] - MON-09_A15 additional information for audit records is provided, as needed.
Assessment rigor: 2
Origin: 171A_R3_A.03.03.02.b
Linkitetyt tehtävät
| Linkin tyyppi | Tehtävä |
|---|---|
| blocks | Content of Event Logs |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.