InformationThe audit system _MUST_ be configured to record enforcement actions of access restrictions, including failed file read (-fr) attempts.
Enforcement actions are the methods or mechanisms used to prevent unauthorized access and/or changes to configuration settings. One common and effective enforcement action method is using access restrictions (e.g., denying access to a file by applying file permissions).
This configuration ensures that audit lists include events in which enforcement actions prevent attempts to read a file.
Without auditing the enforcement of access restrictions, it is difficult to identify attempted attacks, as there is no audit trail available for forensic investigation.
/usr/bin/grep -qE "^flags.*-fr" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-fr/' /etc/security/audit_control;/usr/sbin/audit -s
Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, MAINTENANCE
References: 800-53|AC-2(12), 800-53|AU-2, 800-53|AU-9, 800-53|AU-12, 800-53|AU-12c., 800-53|CM-5(1), 800-53|MA-4(1), CCE|CCE-90866-5, CCI|CCI-000172, CCI|CCI-001814
Control ID: ce2256a4b36509701287810a55488a5dbc7833e98d1c5307076cd54d0c1d98bf