Details

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

The DBMS may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the separate log management facility to absorb audit logs data from comma delimited files produced by extracting the audit data from archived audit logs.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_DB2_V10-5_V1R4_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-4(1)
• CAT|II
• CCI|CCI-001851
• Rule-ID|SV-89249r1_rule
• STIG-ID|DB2X-00-012600
• Vuln-ID|V-74575

Source

• Tenable.com/audits