AU-9 Protection of Audit Information

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	System	7 (3 in a baseline)

Related controls: AC-3, AC-6, AU-6, AU-11, AU-14, AU-15, MP-2, MP-4, PE-2, PE-3, PE-6, SA-8, SC-8, SI-4

Control statement

• a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
• b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.

NIST discussion

Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit logging tools are those programs and devices used to conduct system audit and logging activities. Protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. Physical protection of audit information is addressed by both media protection controls and physical and environmental protection controls.

Control enhancements

AU-9(1) Hardware Write-once Media

Baselines: Not in a baseline

Write audit trails to hardware-enforced, write-once media.

Discussion and assessment objectives for AU-9(1)

Writing audit trails to hardware-enforced, write-once media applies to the initial generation of audit trails (i.e., the collection of audit records that represents the information to be used for detection, analysis, and reporting purposes) and to the backup of those audit trails. Writing audit trails to hardware-enforced, write-once media does not apply to the initial generation of audit records prior to being written to an audit trail. Write-once, read-many (WORM) media includes Compact Disc-Recordable (CD-R), Blu-Ray Disc Recordable (BD-R), and Digital Versatile Disc-Recordable (DVD-R). In contrast, the use of switchable write-protection media, such as tape cartridges, Universal Serial Bus (USB) drives, Compact Disc Re-Writeable (CD-RW), and Digital Versatile Disc-Read Write (DVD-RW) results in write-protected but not write-once media.

Determine if audit trails are written to hardware-enforced, write-once media.

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system hardware settings; system configuration settings and associated documentation; system storage media; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: System media storing audit trails.

AU-9(2) Store on Separate Physical Systems or Components

Baselines: High

Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.

Discussion and assessment objectives for AU-9(2)

Storing audit records in a repository separate from the audited system or system component helps to ensure that a compromise of the system being audited does not also result in a compromise of the audit records. Storing audit records on separate physical systems or components also preserves the confidentiality and integrity of audit records and facilitates the management of audit records as an organization-wide activity. Storing audit records on separate systems or components applies to initial generation as well as backup or long-term storage of audit records.

Determine if audit records are stored [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.

Examine: Audit and accountability policy; system security plan; privacy plan; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system or media storing backups of system audit records; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Mechanisms implementing the backing up of audit records.

AU-9(3) Cryptographic Protection

Baselines: High

Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.

Discussion and assessment objectives for AU-9(3)

Cryptographic mechanisms used for protecting the integrity of audit information include signed hash functions using asymmetric cryptography. This enables the distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Determine if cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system hardware settings; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Cryptographic mechanisms protecting the integrity of audit information and tools.

AU-9(4) Access by Subset of Privileged Users

Baselines: Moderate, High

Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].

Discussion and assessment objectives for AU-9(4)

Individuals or roles with privileged access to a system and who are also the subject of an audit by that system may affect the reliability of the audit information by inhibiting audit activities or modifying audit records. Requiring privileged access to be further defined between audit-related privileges and other privileges limits the number of users or roles with audit-related privileges.

Determine if access to management of audit logging functionality is authorized only to [Assignment: organization-defined subset of privileged users or roles].

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system-generated list of privileged users with access to management of audit functionality; access authorizations; access control list; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms managing access to audit functionality.

AU-9(5) Dual Authorization

Baselines: Not in a baseline

Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].

Discussion and assessment objectives for AU-9(5)

Organizations may choose different selection options for different types of audit information. Dual authorization mechanisms (also known as two-person control) require the approval of two authorized individuals to execute audit functions. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. Organizations do not require dual authorization mechanisms when immediate responses are necessary to ensure public and environmental safety.

Determine if dual authorization is enforced for the [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; access authorizations; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms implementing the enforcement of dual authorization.

AU-9(6) Read-only Access

Baselines: Not in a baseline

Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles].

Discussion and assessment objectives for AU-9(6)

Restricting privileged user or role authorizations to read-only helps to limit the potential damage to organizations that could be initiated by such users or roles, such as deleting audit records to cover up malicious activity.

Determine if read-only access to audit information is authorized to [Assignment: organization-defined subset of privileged users or roles].

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system-generated list of privileged users with read-only access to audit information; access authorizations; access control list; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms managing access to audit information.

AU-9(7) Store on Component with Different Operating System

Baselines: Not in a baseline

Store audit information on a component running a different operating system than the system or component being audited.

Discussion and assessment objectives for AU-9(7)

Storing auditing information on a system component running a different operating system reduces the risk of a vulnerability specific to the system, resulting in a compromise of the audit records.

Determine if audit information is stored on a component running a different operating system than the system or component being audited.

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system audit records; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.

Test: Mechanisms implementing operating system verification capability; mechanisms verifying audit information storage location.

Assessment objectives (SP 800-53A)

Objectives and methods for AU-9

Determine if:

• AU-09a. audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
• AU-09b. [Assignment: organization-defined personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.

Examine: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protection of audit information; system design documentation; system configuration settings and associated documentation; system audit records; audit tools; other relevant documents or records.

Interview: Organizational personnel with audit and accountability responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Mechanisms implementing audit information protection.

Policy statement

• The System owner shall protect audit information and audit logging tools from unauthorized access, modification and deletion. (AU-9a)
• The System owner shall ensure Fill in: personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information Typical: the security operations team and the system owner are alerted when unauthorized access, modification or deletion of audit information is detected. (AU-9b)

AU-9(2) Store on separate physical systems or components

• The System owner shall ensure audit records are stored Fill in: the frequency of storing audit records in a repository Typical: in near real time in a repository on a physically different system or component than the one being audited. (AU-9(2))

AU-9(3) Cryptographic protection of audit information

• The System owner shall ensure cryptographic mechanisms protect the integrity of audit information and audit tools. (AU-9(3))

AU-9(4) Access by subset of privileged users

• The System owner shall authorize access to management of audit logging functionality only for Fill in: a subset of privileged users or roles authorized to access management of audit logging functionality Typical: the security operations administrators, who do not administer the systems being audited. (AU-9(4))

From the Audit and Accountability Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AU-9 asks you to protect audit information and logging tools from unauthorized access, change and deletion, and to alert named people when that is detected. NIST’s AU-9 discussion counts audit records, log settings, audit reports and any personal data in them as audit information. An attacker who gains administrator rights will try to clear the logs first, so assessors look hard at who can change or delete them.

Common implementations. Logs forwarded as they are written to a central platform in a separate account or tenant, where administrators of the audited systems have no rights to change or delete them. Archives kept on immutable storage, such as object storage with a retention lock. Alert rules for log clearing (for example Windows Security event 1102, “the audit log was cleared”), stopped logging agents, and changes to retention or logging settings. Logging tools and agents protected by file permissions and change control. Media holding audit information is protected under the MP and PE controls, as NIST’s discussion notes.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Who is alerted to unauthorized access, change or deletion (b)	The security operations team and the system owner
Who may manage audit logging functionality (AU-9(4))	The security operations administrators, who do not administer the systems being audited
How often records are stored on a separate system (AU-9(2), High)	In near real time

AU-9(3) has no parameter. In the Audit and Accountability policy, the system owner protects the audit information and ensures the alerts are sent.

Evidence assessors ask for.

• The list of people and roles with access to the log platform, and what each can do
• Evidence that administrators of the audited systems cannot delete or change stored records (AU-9(4))
• The alert rules for log clearing, agent stops and setting changes, and a sample alert with its follow-up
• Retention locks or other immutability settings on log archives
• For High, the forwarding settings (AU-9(2)) and the cryptographic integrity mechanism (AU-9(3))

Inheritance. The central log platform, its access roles and its immutable storage are usually common controls. The system owns protecting local logs and agents on its components and restricting who can change its logging, so AU-9 is usually a hybrid control.

Common findings.

• Domain or cloud administrators who are also administrators of the log platform.
• Local logs that an administrator can clear with no alert and no copy elsewhere.
• A shared service account for the log platform used by several teams.
• Analysts with delete rights they do not need.

Enhancements in the Moderate baseline. AU-9(4) access by subset of privileged users, which is also in High. NIST’s AU-9(4) discussion explains why: a privileged user who is also audited by the system can hinder logging or change records. High adds AU-9(2) store on separate physical systems or components and AU-9(3) cryptographic protection. AU-9(1), AU-9(5), AU-9(6) and AU-9(7) are in no baseline.

• AU-9(2) keeps records safe if the audited system is compromised. NIST’s discussion applies it to initial records and to backups and long-term storage alike.
• AU-9(3) protects integrity with cryptography, such as the signed hash functions NIST’s discussion names. Use modules that meet SC-13 and the encryption and key management standard.

Artifacts

• Audit and Accountability Decision Worksheet
• Audit and Accountability Policy
• Audit Logging Standard