Question

Consider a file server where a user is allowed to download files. Each file has an access control list of the users that are allowed to download the file. The security policy is that only users listed in the access control list can download the file. List the information that must be logged by a system that audits this policy.

Answer 1

Operating System(OS) Events o start up and shut down of the system o start up and down down of a service network connection changes or failures o changes to, or attempts. change, system security settings and controls OS Audit Records o log on attempts (successful or unsuccessful) o the function(s) performed after logged on (e.g., reading or updating critical file, software installation) o account changes (e.g., account creation and deletion, account privilege assignment) successful tailed use of privileged accounts Application Account Information o successful and failed application authentication attempts application account changes (e.g., account creation and deletion, account privilege assignment) use of application privileges Application operations application start up and shutdown application failures o major application configuration changes application transactions, for example, � e-mail servers recording the sender, recipients, subject name, and attachment names for each e-mail � Web servers recording each URL requested and the type of response provided by the server � business applications recording which financial records were accessed