ONTAP must automatically audit account-enabling actions.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-246925	SRG-APP-000319-NDM-000283	NAOT-AC-000004	SV-246925r961290_rule	2024-08-22	2

Description
Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail, which documents the creation of application user accounts and notifies administrators and Information System Security Officer (ISSO). Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.

Description

Once an attacker establishes initial access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to simply enable a new or disabled account. Notification of account enabling is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail, which documents the creation of application user accounts and notifies administrators and Information System Security Officer (ISSO). Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.

ℹ️ Check
Use "cluster log-forwarding show" to see if a remote syslog destination is defined for ONTAP. Use commands available on the remote syslog server to check for new account creation or enabling a disabled account. If ONTAP does not automatically audit account-enabling actions, this is a finding.

✔️ Fix
Use "cluster log-forwarding show" to identify defined ONTAP remote syslog servers. If no remote syslog servers are defined, use "cluster log-forwarding create" to define a syslog destination. On the remote syslog server, use commands available to check for new account creation or enabling a disabled account.