+NET.3.2.A9 Logging (B)

NET.3.2.A9 Logging (B)

Firewalls MUST be configured to log the following events at minimum:

  • rejected network connections (source and destination IP addresses, source and destination ports or ICMP/ICMPv6 type, dates, times)
  • failed attempts to access system resources due to improper authentication, lack of authorisation, lack of resources
  • error messages from firewall services
  • general system error messages
  • configuration changes (automatically whenever possible)

If security proxies are used, security breaches and violations of access control lists (ACLs or access lists) MUST be logged in a suitable manner. The types of protocol violations or ACL violations, source and destination IP addresses, source and destination ports, services, dates and times and, if necessary, the duration of connections MUST be logged at minimum.

When a user provides authentication to a security proxy, either the authentication data or solely the information on a failed authentication attempt MUST also be logged.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.41 Sabotage
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information