← Back to Trend Micro Deep Security 9.x Security Technical Implementation Guide

V-241122

CAT II (Medium)

Trend Deep Security must initiate session auditing upon startup.

Rule ID

SV-241122r879562_rule

STIG

Trend Micro Deep Security 9.x Security Technical Implementation Guide

Version

V2R1

CCIs

CCI-001464

Discussion

If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.

Check Content

Review the Trend Deep Security server to ensure session auditing upon startup is initiated.

Verify the following events within the Administration >> System Settings >> System Events, are set to “Record.”
600 User Signed In
601 User Signed Out
602 User Timed Out
603 User Locked Out
608 User Session Validation Failed
610 User Session Validated

If these settings are not set to “Record”, this is a finding.

Fix Text

Configure the Trend Deep Security server to initiate session auditing upon startup.

Go to Administration >> System Settings >> System Events, and set the following settings to “Record.”
600 User Signed In
601 User Signed Out
602 User Timed Out
603 User Locked Out
608 User Session Validation Failed
610 User Session Validated