Network Infrastructure Policy Security Technical Implementation Guide

The Network Infrastructure Policy Security Technical Implementation Guide (V10 R7) has 67 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

67STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V10 · R7

CurrentPublished Thu Oct 24 2024

Syslog messages must be retained for a minimum of 30 days online and then stored offline for one year.

Network Infrastructure Policy Security Technical Implementation Guide

Assessment Title

Rule Text

Syslog messages must be retained for a minimum of 30 days online and then stored offline for one year.

Description

Discussion Text

Logging is a critical part of router security. Maintaining an audit trail of system activity logs (syslog) can help identify configuration errors, understand past intrusions, troubleshoot service disruptions, and react to probes and scans of the network.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251374

Rule

SV-251374r806077_rule

Severity

low

Rule Version

NET1026

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Examine the syslog server to verify that it is configured to store messages for at least 30 days.  Have the administrator show you the syslog files stored offline for one year.

If the syslog messages are not kept online for thirty days and offline for one year, this is a finding.

Implementation Procedure

Fix Text

Configure the syslog server to store messages for at least 30 days on-line. The administrator must establish a strategy for storing the logs off-line for minimum of 1 year.

STIG check 42 of 67 in the Network Infrastructure Policy STIG checklist

← Previous · V-251373A minimum of two syslog servers must be deployed in the management network.Next · V-251375 →Current and previous network element configurations must be stored in a secured location.