JUNI-ND-001440 - The Juniper router must be configured to send log data to a syslog server for the purpose of forwarding alerts to the administrators and the ISSO.

Information

Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of accounts and notifies administrators and Information System Security Officers (ISSOs). Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.

Solution

Configure the router to send log data to a syslog server as shown in the example below.

set syslog host x.x.x.x any info

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_Router_Y22M04_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-2c., CAT|I, CCI|CCI-002605, Rule-ID|SV-220141r401224_rule, STIG-ID|JUNI-ND-001440, STIG-Legacy|SV-101295, STIG-Legacy|V-91195, Vuln-ID|V-220141

Plugin: Juniper

Control ID: 198f6ec51ab1ef06f0fee36cafb251feb1333525d6aa66e424c3e390696db879