Details

In order to be able to provide a forensic history of activity, the application server must ensure users who are granted a privileged role or those who utilize a separate distinct account when accessing privileged functions or data have their actions logged.

If privileged activity is not logged, no forensic logs can be used to establish accountability for privileged actions that occur on the system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select ‘WebLogic Domain’ -> ‘Security’ -> ‘Audit Policy’
3. Select ‘Oracle Platform Security Services’ from the ‘Audit Component Name’ dropdown
4. Beneath ‘Audit Policy Settings’ section, enter the comma-delimited list of privileged users (e.g., WebLogic, etc.) in the ‘Users to Always Audit’ field. Click ‘Apply’

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_WebLogic_Server_12c_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Windows.

References

• 800-53|AU-12c.
• CAT|II
• CCI|CCI-000172
• Rule-ID|SV-235935r628583_rule
• STIG-ID|WBLC-01-000030
• STIG-Legacy|SV-70473
• STIG-Legacy|V-56219
• Vuln-ID|V-235935

Source

• Tenable.com/audits