[Forgot Password]
Login  Register Subscribe

24128

 
 

131615

 
 

112965

 
 

909

 
 

88036

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-90004-3

Platform: macosx10.9Date: (C)2015-06-11   (M)2018-03-17



Audit Account Creation, Modification, and Deletion Account creations and account modfications, such as disablement and termination, can all be signs of an intrusion and should be audited. Once an attacker establishes access to a system, the attacker may attempt to create an account to reestablish access at a later time. The attacker may also attempt to modify accounts in an attempt to change an existing account's privileges or disable or delete accounts in a denial-of-service attack. Auditing of account creation, modification, disabling, and termination events mitigates this risk.


Parameter: EXISTS/DOES NOT EXIST


Technical Mechanism: In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Privileged access, including the creation, modification, and deletion of local user accounts, is logged via the 'ad' flag. If 'ad' is not listed in the result of the check, this is a finding.

References:

Resource IdReference
NISTAU-12 c
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:24638


OVAL    1
oval:org.secpod.oval:def:24638
XCCDF    1
xccdf_org.secpod_benchmark_general_Mac_OS_X_10_9

© SecPod Technologies