Details
A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the System Administrator (SA) and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker’s activity.
Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Open the IIS 10.0 Manager.
Click the IIS 10.0 web server name.
Click the ‘Logging’ icon.
Click ‘Browse’ and navigate to the directory where the log files are stored.
Right-click the log file directory to review and click ‘Properties’.
Click the ‘Security’ tab.
Set the log file permissions for the appropriate group(s).
Click ‘OK’.
Select ‘Apply’ in the ‘Actions’ pane.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Windows.
References
- 800-53|AU-9
- CAT|II
- CCI|CCI-000164
- Rule-ID|SV-218790r561041_rule
- STIG-ID|IIST-SV-000115
- STIG-Legacy|SV-109219
- STIG-Legacy|V-100115
- Vuln-ID|V-218790