Detections
Analytics

WBSP-AS-000380 - The WebSphere Application Server must generate log records when attempts to access subject privileges occur.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Accessing a subject's privileges can be used to elevate a lower-privileged subject's privileges temporarily in order to cause harm to the application server or to gain privileges to operate temporarily for a designed purpose. When these actions take place, the event needs to be logged.

Application servers either provide a local user store, or they integrate with enterprise user stores like LDAP. When the application server provides the user store and enforces authentication, the application server must generate a log record when modification of privileges is successfully or unsuccessfully performed.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

In the administrative console, navigate to Security >> Security auditing >> Audit Service Provider.

Click on the providers in the list.

Note the names of all the filters, e.g., 'DefaultAuditSpecification_1'.

Go back to Security >> Security auditing >> Event type Filters.

Find the filters previously noted.

If you do not see that the provider filter for SECURITY_AUTHN, SECURITY_AUTHZ, SECURITY_AUTHN_TERMINATE, and ADMIN_REPOSITORY_SAVE that has INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING defined, click the 'New' button to create a new filter.

Give it a unique name.

Select 'SECURITY_AUTHN' and 'ADMIN_REPOSITORY_SAVE' from the 'Events to associate with audit filter' field.

Click the right arrow to fill in 'Enabled events' field.

From 'Event outcomes to associate with an audit filter' field, select INFO, ERROR, SUCCESS, DENIED, REDIRECT, and WARNING.

Click the right arrow to fill in 'Enabled event outcomes' field.

Click 'OK'.

Go back to Security >> Security auditing >> Audit Service Provider >> [provider].

Under 'Selectable filters', select the new filter just created.

Click the right arrow to add it to the list.

Click 'OK'.

Click 'Save'.

Restart the DMGR and all the JVMs.

See Also

http://iasecontent.disa.mil/stigs/zip/U_IBM_WebSphere_Traditional_V9-x_V1R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CAT|III, CCI|CCI-000172, Rule-ID|SV-95951r1_rule, STIG-ID|WBSP-AS-000380, Vuln-ID|V-81237

Plugin: Windows

Control ID: 6df72a59a384dc206ca09373044ec0daa9017947dd876da675ebfafe50513fac