The application server must protect log information from unauthorized modification.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-204733	SRG-APP-000119	SRG-APP-000119-AS-000079	SV-204733r960933_rule	2025-02-11	4

Description
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.

Description

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.

ℹ️ Check
Review the configuration settings to determine if the application server log features protect log information from unauthorized modification. Review file system settings to verify the application server sets secure file permissions on log files to prevent unauthorized modification. If the application server does not protect log information from unauthorized modification, this is a finding.

✔️ Fix
Configure the application server to protect log information from unauthorized modification.