OpenControls Logo

STIG Viewer

STIGViewer Support

Symantec ProxySG must use a centralized log server.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-94257SYMP-AG-000210SV-104211r1_ruleCCI-001851medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. This does not apply to audit logs generated on behalf of the device itself (management).
STIGDate
Symantec ProxySG ALG Security Technical Implementation Guide2020-03-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-08.1Event Log Backup on Separate Physical Systems / Components
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(1)System-wide and Time-correlated Audit Trail
1.00
AU-12(3)Changes by Authorized Individuals
1.00
AU-14(1)System Start-up
1.00

+24 more (top 10 by confidence shown)

CCI1 mapping
CCI-001851
1.00

Details

Check Text (C-104211r1_chk)

Determine whether audit log off-loading is configured. 1. Log on to the Web Management Console. 2. Browse to Configuration >> Access Logging >> Logs. 3. Click "Upload Client" and Verify that a "Client type" is specified. All client types use TCP for communication to the target server (FTP/S, HTTP/S, Kafka, etc.). If Symantec ProxySG does not use a centralized log server, this is a finding.

Fix Text (F-100373r1_fix)

Configure audit log off-loading. 1. Log on to the Web Management Console. 2. Browse to Configuration >> Access Logging >> Logs. 3. Configure the "Upload Client" and "Upload Schedule" capabilities. (All client types use TCP for communication to the site's event server.)