3.2.2.1: Unix: Difference between revisions
No edit summary |
No edit summary |
||
| Line 26: | Line 26: | ||
'''Control Stewards Process Narrative''' | '''Control Stewards Process Narrative''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
Currently, no active notification of security violations occurs. If there is suspicion of activity, IT Security would work with the Systems Software group to access to security logs on each AIX host. | <p><font color=#FF0000>Currently, no active notification of security violations occurs. If there is suspicion of activity, IT Security would work with the Systems Software group to access to security logs on each AIX host.</font></p> | ||
<br> | <br> | ||
| Line 41: | Line 41: | ||
'''Control Status and Auditors Commentary''' | '''Control Status and Auditors Commentary''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
The control is not effective at this time because automatic system alerts are not being generated to provide effective proactive security event alerts to the security administrators.< | <p><font color=#FF0000>The control is not effective at this time because automatic system alerts are not being generated to provide effective proactive security event alerts to the security administrators.</font></p> | ||
<br> | <br> | ||
[[Image:redlock.jpg]]<br> | [[Image:redlock.jpg]]<br> | ||
Revision as of 16:21, 2 May 2006
9. Risk: Inappropriate administrative actions are executed without accountability measures.
- a. SOX.4.2.1.9: The UNIX operating system application has forensic auditing enabled to enable the monitoring of administrative access related events.
Testing Procedures
Obtain a copy of an automatic notification message produced by the system being tested to verify that the security administrators are being proactively notified of possible access violations.
An example might be a monitoring background process that sends an electronic message to the security administrative group automatically when root access occurs. The email message will provide a date, time, source, destination, and responsible entity to satisfy compliance requirements.
Testing Frequency
Semi- Annual validation of all systems within scope.
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Currently, no active notification of security violations occurs. If there is suspicion of activity, IT Security would work with the Systems Software group to access to security logs on each AIX host.
Control Steward – Steve Somebody
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is not effective at this time because automatic system alerts are not being generated to provide effective proactive security event alerts to the security administrators.
File:Redlock.jpg
Creating simple monitoring shell scripts or implementing a commercial solution is advised.
Control Exception Commentary
Status in not acceptable.
Remediation Plan
Implement a CRON driven shell script to monitor activity logs. Alert activity should be proactively forwarded to security administrators as these events occur ideally through electronic mail. The security administrator should investigate suspect activities and document any findings. This action report should be archived for compliance testing purposes.