Detections
Analytics

ARBA-ND-000289 - AOS must audit the execution of privileged functions.

Information

Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.

Satisfies: SRG-APP-000343-NDM-000289, SRG-APP-000101-NDM-000231, SRG-APP-000504-NDM-000321

Solution

Configure AOS with the following commands:
configure terminal
audit-trail all
write memory

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_HPE_Aruba_Networking_AOS_Y26M04_STIG.zip

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-6(9), 800-53|AU-3(1), 800-53|AU-12c., CAT|II, CCI|CCI-000135, CCI|CCI-000172, CCI|CCI-002234, Rule-ID|SV-266950r1039871_rule, STIG-ID|ARBA-ND-000289, Vuln-ID|V-266950

Plugin: ArubaOS

Control ID: 2ca2206be7f4fa7daa52ddc40ed5cf92b612af0c8e7f8d8c1b82cca7e9a6e1b5