Input requested - CCI-000880 - "non-local maintenance"

Shawn Wells shawn at redhat.com
Fri Apr 27 02:21:23 UTC 2012


On 4/25/12 5:31 PM, Shawn Wells wrote:
> CCI-000880 says:
>
> "The operating system must audit non-local maintenance and diagnostic 
> sessions." and
> "Non-local maintenance and diagnostic activities are those activities 
> conducted by individuals communicating through a network, either an 
> external network (e.g., the Internet) or an internal network, in order 
> to conduct system diagnostics.
>
> For traceability of maintenance, logging events associated with a 
> non-local administrative access or diagnostic session must be performed."
>
> What actions do we want to consider "maintenance and diagnostic" 
> commands/tools? 

Another way of looking at this is that we have to audit the "session": 
Does this mean literally, such as down to the keystrokes (we can do that 
if needed)?


More information about the scap-security-guide mailing list