[PATCH 59/64] Mapped IR-5 to audit requirements

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:21:43 UTC 2013


-------------- next part --------------
>From e1fc901cefdae73a27cd87bcb7a4e9929d19e1cd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 21:34:09 -0400
Subject: [PATCH 59/64] Mapped IR-5 to audit requirements
 IR-5 calls for documenting security incidents, which is the purpose of audit

---
 RHEL6/input/system/auditing.xml |   83 +++++++++++++++++++--------------------
 1 files changed, 41 insertions(+), 42 deletions(-)

diff --git a/RHEL6/input/system/auditing.xml b/RHEL6/input/system/auditing.xml
index abe5472..1c907bd 100644
--- a/RHEL6/input/system/auditing.xml
+++ b/RHEL6/input/system/auditing.xml
@@ -93,7 +93,7 @@ actions will be taken if other obstacles exist.
 </rationale>
 <ident cce="27058-7" />
 <oval id="service_auditd_enabled" />
-<ref nist="AC-17(1),AU-1(b),AU-10,AU-12(a),AU-12(c)" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
+<ref nist="AC-17(1),AU-1(b),AU-10,AU-12(a),AU-12(c),IR-5" disa="347,157,172,880,1353,1462,1487,1115,1454,067,158,831,1190,1312,1263,130,120,1589" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -118,7 +118,7 @@ process during boot.
 </rationale>
 <ident cce="26785-6" />
 <oval id="bootloader_audit_argument" />
-<ref nist="AC-17(1),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-10" disa="1464,130" />
+<ref nist="AC-17(1),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-10,IR-5" disa="1464,130" />
 </Rule>
 
 <Group id="configure_auditd_data_retention">
@@ -246,7 +246,7 @@ determine how many logs the system is configured to retain after rotation:
 log information over the period required. This is a function of the maximum log
 file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_num_logs" value="var_auditd_num_logs" /> 
-<ref nist="AU-1(b),AU-11" />
+<ref nist="AU-1(b),AU-11,IR-5" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -270,7 +270,7 @@ determine how much data the system will retain in each audit log file:
 log information over the period required. This is a function of the maximum
 log file size and the number of logs retained.</rationale>
 <oval id="auditd_data_retention_max_log_file" value="var_auditd_max_log_file" /> 
-<ref nist="AU-1(b),AU-11" />
+<ref nist="AU-1(b),AU-11,IR-5" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -306,7 +306,7 @@ log data, or which use external processes to transfer it and reclaim space,
 <tt>keep_logs</tt> can be employed.</rationale>
 <ident cce="27237-7" />
 <oval id="auditd_data_retention_max_log_file_action" value="var_auditd_max_log_file_action" />
-<ref nist="AU-1(b),AU-4,AU-11" />
+<ref nist="AU-1(b),AU-4,AU-11,IR-5" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -359,7 +359,7 @@ Acceptable values are <tt>email</tt>, <tt>suspend</tt>, <tt>single</tt>, and <tt
 allow them to take corrective action prior to any disruption.</rationale>
 <ident cce="27238-5" />
 <oval id="auditd_data_retention_space_left_action" value="var_auditd_space_left_action"/>
-<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,143" />
+<ref nist="AU-1(b),AU-4,AU-5(b),IR-5" disa="140,143" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -401,11 +401,10 @@ is used, running low on space for audit records should never occur.
 </rationale>
 <ident cce="27239-3" />
 <oval id="auditd_data_retention_admin_space_left_action" value="var_auditd_admin_space_left_action" />
-<ref nist="AU-1(b),AU-4,AU-5(b)" disa="140,1343" />
+<ref nist="AU-1(b),AU-4,AU-5(b),IR-5" disa="140,1343" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
-
 <Rule id="configure_auditd_action_mail_acct" severity="medium">
 <title>Configure auditd mail_acct Action on Low Disk Space</title>
 <description>The <tt>auditd</tt> service can be configured to send email to
@@ -424,7 +423,7 @@ account when it needs to notify an administrator:
 administrators of the system, who can take appropriate action.</rationale>
 <ident cce="27241-9" />
 <oval id="auditd_data_retention_action_mail_acct" value="var_auditd_action_mail_acct" />
-<ref nist="AU-1(b),AU-4,AU-5(a)" disa="139,144" />
+<ref nist="AU-1(b),AU-4,AU-5(a),IR-5" disa="139,144" />
 </Rule>
 
 <Rule id="configure_auditd_audispd" severity="medium">
@@ -444,7 +443,7 @@ If the plugin is active, the output will show <tt>yes</tt>.
 records to a centralized server for management directly.  It does, however, 
 include an audit event multiplexor plugin (audispd) to pass audit records 
 to the local syslog server</rationale>
-<ref nist="AU-1(b),AU-3(2)" disa="136" />
+<ref nist="AU-1(b),AU-3(2),IR-5" disa="136" />
 </Rule>
 
 </Group>
@@ -519,7 +518,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="26242-8" />
 <oval id="audit_rules_time_adjtimex" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -547,7 +546,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27203-9" />
 <oval id="audit_rules_time_settimeofday" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -573,7 +572,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27169-2" />
 <oval id="audit_rules_time_stime" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -601,7 +600,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27170-0" />
 <oval id="audit_rules_time_clock_settime" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 <ref disa="1487,169" />
 </Rule>
 
@@ -626,7 +625,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
 to the system time should be audited.</rationale>
 <ident cce="27172-6" />
 <oval id="audit_rules_time_watch_localtime" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 <ref disa="1487,169" />
 </Rule>
 </Group><!--End <Group id="audit_time_rules"> -->
@@ -655,7 +654,7 @@ unexpected users, groups, or modifications should be investigated for
 legitimacy.</rationale>
 <ident cce="26664-3" />
 <oval id="audit_rules_usergroup_modification" />
-<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
+<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
 </Rule>
 
 <Rule id="audit_network_modifications">
@@ -681,7 +680,7 @@ than administrator action. Any change to network parameters should be
 audited.</rationale>
 <ident cce="26648-6" />
 <oval id="audit_rules_networkconfig_modification" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 </Rule>
 
 <Rule id="audit_logs_permissions">
@@ -700,7 +699,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 </rationale>
 <ident cce="27243-5" />
 <oval id="file_permissions_var_log_audit" />
-<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9,IR-5" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -716,7 +715,7 @@ If users can write to audit logs, audit trails can be modified or destroyed.
 owner, and unauthorized users, potential access to sensitive information.</rationale>
 <ident cce="27244-3" />
 <oval id="file_ownership_var_log_audit" />
-<ref nist="AC-6,AU-1(b),AU-9" disa="166" />
+<ref nist="AC-6,AU-1(b),AU-9,IR-5" disa="166" />
 <tested by="DS" on="20121024"/>
 </Rule> 
 
@@ -738,7 +737,7 @@ arbitrarily changed by anything other than administrator action. All changes to
 MAC policy should be audited.</rationale>
 <ident cce="26657-7" />
 <oval id="audit_rules_mac_modification" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 </Rule>
 
 <Group id="audit_dac_actions">
@@ -798,7 +797,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="26280-8" />
 <oval id="audit_rules_dac_modification_chmod" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_chown">
@@ -826,7 +825,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27173-4" />
 <oval id="audit_rules_dac_modification_chown" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmod">
@@ -854,7 +853,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27174-2" />
 <oval id="audit_rules_dac_modification_fchmod" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchmodat">
@@ -882,7 +881,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27175-9" />
 <oval id="audit_rules_dac_modification_fchmodat" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchown">
@@ -910,7 +909,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27177-5" />
 <oval id="audit_rules_dac_modification_fchown" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fchownat">
@@ -938,7 +937,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27178-3" />
 <oval id="audit_rules_dac_modification_fchownat" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fremovexattr">
@@ -966,7 +965,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27179-1" />
 <oval id="audit_rules_dac_modification_fremovexattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_fsetxattr">
@@ -994,7 +993,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27180-9" />
 <oval id="audit_rules_dac_modification_fsetxattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lchown">
@@ -1022,7 +1021,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27181-7" />
 <oval id="audit_rules_dac_modification_lchown" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lremovexattr">
@@ -1050,7 +1049,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27182-5" />
 <oval id="audit_rules_dac_modification_lremovexattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_lsetxattr">
@@ -1078,7 +1077,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27183-3" />
 <oval id="audit_rules_dac_modification_lsetxattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_removexattr">
@@ -1106,7 +1105,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27184-1" />
 <oval id="audit_rules_dac_modification_removexattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_rules_dac_modification_setxattr">
@@ -1134,7 +1133,7 @@ calls with others as identifying earlier in this guide is more efficient.
 </warning>
 <ident cce="27185-8" />
 <oval id="audit_rules_dac_modification_setxattr" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 </Group> <!-- <Group id="audit_dac_actions"> -->
@@ -1151,7 +1150,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26691-6" />
 <oval id="audit_rules_login_events" />
-<ref nist="AC-17(7),AU-1(b)" />
+<ref nist="AC-17(7),AU-1(b),IR-5" />
 </Rule>
 
 <Rule id="audit_manual_session_edits">
@@ -1168,7 +1167,7 @@ storing such process information, add the following to
 as an attacker attempting to remove evidence of an intrusion.</rationale>
 <ident cce="26610-6" />
 <oval id="audit_rules_session_events" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 </Rule>
 
 <Rule id="audit_file_access">
@@ -1191,7 +1190,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
 these events could serve as evidence of potential system compromise.</rationale>
 <ident cce="26712-0" />
 <oval id="audit_rules_unsuccessful_file_modification" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" />
 </Rule>
 
 <Rule id="audit_privileged_commands">
@@ -1219,7 +1218,7 @@ unusual activity.
 </rationale>
 <ident cce="26457-2" />
 <oval id="audit_rules_privileged_commands" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4)" disa="40" />
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),IR-5" disa="40" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1241,7 +1240,7 @@ trail should be created each time a filesystem is mounted to help identify and g
 loss.</rationale>
 <ident cce="26573-6" />
 <oval id="audit_rules_media_export" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1263,7 +1262,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as
 malicious processes that attempt to delete log files to conceal their presence.</rationale>
 <ident cce="26651-0" />
 <oval id="audit_rules_file_deletion_events" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_sysadmin_actions">
@@ -1281,7 +1280,7 @@ To verify that auditing is configured for system administrator actions, run the
 of what was executed on the system, as well as, for accountability purposes.</rationale>
 <ident cce="26662-7" />
 <oval id="audit_rules_sysadmin_actions" />
-<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -1303,7 +1302,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp
 to have an audit trail of modules that have been introduced into the kernel.</rationale>
 <ident cce="26611-4" />
 <oval id="audit_rules_kernel_module_loading" />
-<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d)" disa="126"/>
+<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
 </Rule>
 
 <Rule id="audit_config_immutable">
@@ -1319,7 +1318,7 @@ problematic if legitimate changes are needed during system
 operation</rationale>
 <ident cce="26612-2" />
 <oval id="audit_rules_immutable" />
-<ref nist="AC-6,AU-1(b),AU-2(a),AU-2(c),AU-2(d)" />
+<ref nist="AC-6,AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
 </Rule>
 </Group>
 
-- 
1.7.1



More information about the scap-security-guide mailing list