Detections
Analytics

5.2.3.5 Ensure successful file system mounts are collected

Information

Monitor the use of the mount system call. The mount (and umount ) system call controls the mounting and unmounting of file systems. The parameters below configure the system to create an audit record when the mount system call is used by a non-privileged user

It is highly unusual for a non-privileged user to mount file systems to the system. While tracking mount commands gives the system administrator evidence that external media may have been mounted (based on a review of the source of the mount and confirming it's an external media type), it does not conclusively indicate that data was exported to the media. System administrators who wish to determine if data were exported, would also have to track successful open, creat, and truncate system calls required to write access to a file under the mount point of the external media file system. This could give a fair indication that a write occurred. The only way to truly prove it would be to track successful writes to the external media. Tracking write system calls could quickly fill up the audit log and is not recommended. Recommendations on configuration options to track data export to media are beyond the scope of this document.

Solution

Edit the file /etc/security/audit_control, with the relevant rules to monitor events that perform administrative actions as a whole.

Modify the flags directive to match the following:

flags:ad

This flag should be added if there were other flags previously configured rather than replacing the entire line.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|6.3

Plugin: Unix

Control ID: ffedadb34634d7f81490f97931ed553c492957b05b34aab63376c345e814bdb0