3.3 Audit and Accountability

Statement

Store audit records in a repository that is part of a physically different system or system component than the system or component being audited.

Guidance

Storing audit records in a repository that is separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components preserves the confidentiality, integrity, and availability of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or system components applies to the initial generation and backup or long-term storage of audit records. This requirement enhances SP 800-171 requirement 03.03.08.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited.

Assessment method

• Audit and accountability policy system security plan procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system or media storing backups of system audit records system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers

Assessment method

• Mechanisms implementing the backing up of audit records

Statement

Provide an alert within {{ insert: param, A.03.03.02E.ODP.01 }} to {{ insert: param, A.03.03.02E.ODP.02 }} when the following audit failure events occur: {{ insert: param, A.03.03.02E.ODP.03 }}.

Guidance

Alerts provide organizations with urgent messages. Real-time alerts provide these messages at information technology speed (i.e., the time from event detection to alert occurs in seconds or less). This requirement enhances SP 800-171 requirement 03.03.04.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

an alert is provided within {{ insert: param, A.03.03.02E.ODP.01 }} to {{ insert: param, A.03.03.02E.ODP.02 }} when {{ insert: param, A.03.03.02E.ODP.03 }} occur.

Assessment method

• Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan system configuration settings and associated documentation system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers

Statement

Enforce dual authorization for {{ insert: param, A.03.03.03E.ODP.01 }} of {{ insert: param, A.03.03.03E.ODP.02 }}.

Guidance

Dual authorization is also known as two-person control since it requires the approval of two authorized individuals to reduce the risk related to insider threat when executing audit functions. Dual authorization reduces risks related to insider threats, including adversaries who have obtained credentials. Organizations may choose different selection options for different types of audit information. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations consider the risk associated with implementing dual authorization when immediate responses are necessary to ensure public and environmental safety. This requirement enhances SP 800-171 requirement 03.03.08. It is also related to requirement 03.01.01E.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization is enforced for the {{ insert: param, A.03.03.03E.ODP.01 }} of {{ insert: param, A.03.03.03E.ODP.02 }}.

Assessment method

• Audit and accountability policy system security plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation access authorizations system audit records other relevant documents or records

Assessment method

• Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms implementing the enforcement of dual authorization

Statement

Integrate analysis of audit records with analysis of {{ insert: param, A.03.03.04E.ODP.01 }} to further enhance the ability to identify inappropriate or unusual activity.

Guidance

Integrated analysis of audit records requires that the analysis of information generated by scanning, monitoring, or other data collection activities is integrated with the analysis of audit record information. Security information and event management (SIEM) tools can facilitate audit record aggregation or consolidation from multiple system components as well as audit record correlation and analysis. The use of standardized audit record analysis scripts developed by organizations (with localized script adjustments, as necessary) provides more cost-effective approaches to analyzing audit record information. The correlation of audit record information with vulnerability scanning information is important in determining the veracity of vulnerability scans of the system and in correlating attack detection events with scanning results. Correlation with performance data can uncover denial-of-service (DoS) attacks or other types of attacks that result in the unauthorized use of resources. Correlation with system monitoring information can also assist in uncovering attacks and relating audit information to operational situations. This requirement enhances SP 800-171 requirement 03.03.05.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

analysis of audit records is integrated with analysis of {{ insert: param, A.03.03.04E.ODP.01 }} to further enhance the ability to identify inappropriate or unusual activity.

Assessment method

• Audit and accountability policy system security plan procedures addressing audit review, analysis, and reporting system design documentation system configuration settings and associated documentation integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation other relevant documents or records

Assessment method

• Personnel with audit review, analysis, and reporting responsibilities personnel with information security responsibilities

Assessment method

• Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources