What changed in Central Log Server Security Requirements Guide V3R5V3R5 changes

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoDDoW-approved PKIs, all DoDDoW systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. This requirement also applies to Zero Trust initiatives. This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.

V-206447 in V3R5

Discussion

Log servers (e.g., syslog servers) are often used on network segments to consolidate from the devices and hosts on that network segment. However, this does not achieve compliance with the DoDDoW requirement for a centralized enclave log server. To comply with this requirement, create a central log server that aggregates multiple log servers or use another method to ensure log analysis and management is centrally managed and available to enterprise forensics and analysis tools. This server is often called a log aggregator, SIEM, or events server.

V-206451 in V3R5

Title

The Central Log Server must be configured to retain the DoDW-defined attributes of the log records sent by the devices and hosts.

Check text

Examine the configuration. Verify the Central Log Server retains the DoDDoW-defined attributes of the log records sent by the devices and hosts. If the Central Log Server is not configured to retain the DoDDoW-defined attributes of the log records sent by the devices and hosts, this is a finding.

Fix text

Configure the Central Log Server to retain the DoDW-defined attributes of the log records sent by the devices and hosts.

Discussion

Log records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating log records. DoDDoW has defined a list of information or attributes that must be included in the log record, including date, time, source, destination, module, severity level (category of information), etc. Other log record content that may be necessary to satisfy the requirement of this policy includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked.

V-206453 in V3R5

Check text

Examine the configuration. Verify the Central Log Server is configured to require DoDDoW PKI or another multifactor authentication method for logon via the network for all privileged accounts. If the account of last resort is used for logon via the network (not recommended), then verify it is configured to require multifactor authentication method. If the Central Log Server is not configured to use multifactor authentication for network access to privileged user accounts, this is a finding.

Fix text

This requirement applies to all privileged accounts used for access to the system via network access. For systems where individual users access, configure and/or manage the system, configure the Central Log server application to use DoDDoW PKI (preferred) or another multifactor authentication solution for network access to logon to the Central Log Server. If the account of last resort is used for logon via the network (not recommended), then configure the account to require multifactor authentication method.

V-206461 in V3R5

Check text

Examine the configuration. Verify the Central Log Server is configured to require DoDDoW PKI or another multifactor authentication method for logon via the network for all non-privileged accounts. If the Central Log Server is not configured to use multifactor authentication for network access to non-privileged user accounts, this is a finding.

Fix text

This requirement applies to all non-privileged accounts used for access to the system via network access. For systems where individual users access, configure and/or manage the system, configure the Central Log Server to use DoDDoW PKI (preferred) or another multifactor authentication solution for network access to logon to the Central Log Server.

Discussion

To assure accountability and prevent unauthenticated access, non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A non-privileged account is any information system account with authorizations of a non-privileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection. Applications integrating with the DoDDoW Active Directory and utilize the DoDDoW CAC are examples of compliant multifactor authentication solutions.

V-206462 in V3R5

Check text

Examine the configuration. Verify the Central Log Server is configured to require DODDoW PKI or another multifactor authentication method for local logon. If the Central Log Server is not configured to use multifactor authentication for local access using privileged accounts, this is a finding.

Fix text

This requirement applies to all privileged user accounts used for local logon to the application. For systems where individual users access, configure, and/or manage the system, configure the Central Log Server to use DODDoW PKI (preferred) or another multifactor authentication solution for local logon to the Central Log Server.

Discussion

To ensure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication is defined as using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. Applications integrating with the DODDoW Active Directory and utilize the DODDoW common access card (CAC) are examples of compliant multifactor authentication solutions.

V-206463 in V3R5

Check text

Examine the configuration. Verify the Central Log Server is configured to use DODDoW PKI or another form of multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. If the Central Log Server is not configured to use multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access, this is a finding.

Fix text

This requirement applies to all privileged user accounts used for network logon to the application. Configure the Central Log Server to use DODDoW PKI or another form of multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Discussion

Using an authentication device, such as a DODDoW common access card (CAC) or token separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards, such as the U.S. Government Personal Identity Verification card and the DODDoW CAC. A privileged account is any information system account with authorizations of a privileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection.

V-206464 in V3R5

Discussion

A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack. Anti-replay is a cryptographically based mechanism; thus, it must use FIPS-approved algorithms. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Note that the anti-replay service is implicit when data contains monotonically increasing sequence numbers and data integrity is assured. Use of DoDDoW PKI is inherently compliant with this requirement for user and device access. Use of Transport Layer Security (TLS), including application protocols, such as HTTPS and DNSSEC, that use TLS/SSL as the underlying security protocol is also complaint. Configure the information system to use the hash message authentication code (HMAC) algorithm for authentication services to Kerberos, SSH, web management tool, and any other access method.

V-206465 in V3R5

Discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor common access card (CAC)-enabled authentication. Examples of situations where a user ID and password might be used include: - When the user does not use a CAC and is not a current DODDoW employee, member of the military, or DODDoW contractor. - When a user has been officially designated as temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) (i.e., Temporary Exception User) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied. - When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection. If the password is already encrypted and not a plaintext password, this meets this requirement. Implementation of this requirement requires configuration of a FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security. Verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the hash. A more secure version of verifying a user knowing a password is to store the result of an iterating hash function and a large random salt value as follows: H0 = H(pwd, H(salt)) Hn = H(Hn-1,H(salt)) In the above, "n" is a cryptographically-strong random [*3] number. "Hn" is stored along with the salt. When the application wishes to verify that the user knows a password, it simply repeats the process and compares "Hn" with the stored "Hn". A salt is essentially a fixed-length cryptographically strong random value. Another method is using a keyed-hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.

V-206474 in V3R5

Title

The Central Log Server must be configured to enforce a 6180-day maximum password lifetime restriction.

Check text

Examine the configuration. Verify the Central Log Server is configured to enforce a 60180-day maximum password lifetime restriction. If the Central Log Server is not configured to enforce a 60180-day maximum password lifetime restriction, this is a finding.

Fix text

Configure the Central Log Server to enforce a 6180-day maximum password lifetime restriction.

V-206477 in V3R5

Discussion

If the audit reduction capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. Audit reduction capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools. This requirement is specific to applications with audit reduction capabilities.

V-206498 in V3R5

Discussion

If the report generation capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. The report generation capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools. This requirement is specific to applications with report generation capabilities; however, applications need to support on-demand reporting requirements.

V-206501 in V3R5

Title

The Central Log Server must be configured to accept the DoDW common access card (CAC) credential to support identity management and personal authentication.

Check text

Examine the configuration. Verify the Central Log Server is configured to accept the DoDDoW CAC credential to support identity management and personal authentication. If the Central Log Server cannot be configured to accept the DoDDoW CAC credential to support identity management and personal authentication, this is a finding.

Fix text

Configure the Central Log Server to accept the DoDW CAC credential to support identity management and personal authentication.

Discussion

The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems. If the application cannot meet this requirement, the risk may be mitigated through use of an authentication server.

V-206506 in V3R5

Title

The Central Log Server must be configured to electronically verify the DoDW common access card (CAC) credential.

Check text

Examine the configuration. Verify the Central Log Server is configured to accept the DoDDoW CAC credentials to support identity management and personal authentication. If the Central Log Server cannot be configured to accept the DoDDoW CAC credentials to support identity management and personal authentication, this is a finding.

Fix text

Configure the Central Log Server to accept the DoDW CAC credentials to support identity management and personal authentication.

Discussion

The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.

V-206507 in V3R5

Discussion

In this case the information producer is the device based on IP address or some other identifier of the device producing the information. The source of the record must be bound to the record using cryptographic means. Some events servers allow the administrator to retain only portions of the record sent by devices and hosts. This requirement applies to log aggregation servers with the role of fulfilling the DoDDoW requirement for a central log repository. The syslog, SIEM, or other event servers must retain this information with each log record to support incident investigations.

V-206512 in V3R5

Discussion

If the Central Log Server is configured to filter or remove account log records transmitted by devices and hosts within its scope of coverage, forensic analysis tools will be less effective at detecting and reporting on important attack vectors. A comprehensive account management process must include capturing log records for the creation of user accounts and notification of administrators and/or application owners. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. This requirement addresses the concern that the Central Log Server may be configured to filter out certain levels of information, which may result in the discarding of DoDDoW-required accounting actions addressed in the AC-2 (4) controls such as creation, modification, deletion, and removal of privileged accounts.

V-206516 in V3R5

Discussion

This supports prioritization functions, which is a major reason why centralized management is a requirement in DoDDoW. This includes different features that help highlight the important events over less critical security events. This may be accomplished by correlating security events with vulnerability data or other asset information. Prioritization algorithms often use severity information provided by the original log source as well. The criticality levels used by the site and the actions that are taken based on the levels established for each system are documented in the SSP. These levels and actions can only be leveraged for alerts, notifications, and reports which correlate asset information if they are configured in the Central Log Server.

V-206517 in V3R5

Title

Analysis, viewing, and indexing functions, services, and applications used as part of the Central Log Server must be configured to comply with DoDDoW-trusted path and access requirements.

Check text

Examine the configuration. Verify analysis, viewing, and indexing functions, services, and applications used with the Central Log Server are configured to comply with DoDDoW-trusted path and access requirements. If analysis, viewing, and indexing functions, services, and applications used with the Central Log Server are not configured to comply with DoDDoW-trusted path and access requirements, this is a finding.

Fix text

Configure all analysis, viewing, and indexing functions, services, and applications used with the Central Log Server to comply with DoDDoW-trusted path and access requirements.

V-206518 in V3R5

Title

The Central Log Server must display the Standard Mandatory DoDW Notice and Consent Banner before granting access to the Central Log Server.

Check text

Examine the configuration. Verify that the Central Log Server is configured to display the Mandatory DoDDoW Notice and Consent Banner before granting access to the Central Log Server. If the Central Log Server is not configured to display the Mandatory DoDDoW Notice and Consent Banner, this is a finding.

Fix text

Configure the Central Log Server to display the Mandatory DoDW Notice and Consent Banner before granting access to the Central Log Server.

Discussion

Display of the DoDDoW-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-221905 in V3R5

Title

The Central Log Server must retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

Check text

Examine the configuration. Verify that the Central Log Server is configured to retain the Mandatory DoDDoW Notice and Consent Banner until users acknowledge the usage conditions. If the Central Log Server is not configured to retain the Mandatory DoDDoW Notice and Consent Banner until users acknowledge the usage conditions, this is a finding.

Fix text

Configure the Central Log Server to retain the Mandatory DoDW Notice and Consent Banner until users acknowledge the usage conditions.

Discussion

The banner must be acknowledged by the user prior to allowing the user access to the application. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoDDoW will not be in compliance with system use notifications required by law. To establish acceptance of the application usage policy, a click-through banner at application logon is required. The application must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating "OK".

V-221906 in V3R5

Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances. (i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change; (iv) When the execution of privileged functions occurs; (v) After a fixed period of time; or (vi) Periodically. Within the DODDoW, the minimum circumstances requiring reauthentication are privilege escalation and role changes.

V-221926 in V3R5

Title

The Central Log Server must only allow the use of DoDDoW PKIPublic Key Infrastructure (PKI)-established certificate authorities for verification of the establishment of protected sessions.

Check text

Examine the configuration. Verify the Central Log Server is configured to only allow the use of DoDDoW PKI certificate authorities. If the Central Log Server is not configured to only allow DoDDoW PKI certificate authorities, this is a finding.

Fix text

Configure the Central Log Server to only allow the use of DoDW PKI certificate authorities.

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoDDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoDDoW-approved CA, trust of this CA has not been established. The DoDDoW will only accept PKI certificates obtained from a DoDDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of TLS certificates. This requirement focuses on communications protection for the application session rather than for the network packet. This requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).

V-221927 in V3R5