V-255256

Discussion

Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform management functions. By providing remote access information to an external monitoring system, the organization can monitor for cyber attacks and monitor compliance with remote access policies. The organization can also look at data organization wide and determine an attack or anomaly is occurring on the organization which might not be noticed if the data were kept local to the web server. Examples of external applications used to monitor or control access would be audit log monitoring systems, dynamic firewalls, or infrastructure monitoring systems.

Check Content

Verify that SSMC monitors remote access by doing the following:

1. Log on to SSH as ssmcadmin. Press "X" to escape to general bash shell.

2. Execute the following command to enable TCP access logs:

$ sudo /ssmc/bin/config_security.sh -o  tcp_access_log  -a status

TCP access logging is enabled

If the command output does not read "TCP access logging is enabled", this is a finding.