V-286176

Discussion

Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. Suppression of auditing could permit an adversary to evade detection. Misconfigured audits can degrade the systems performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Check Content

Verify audit tables exist:

SHOW TABLES FROM mysql LIKE 'server_audit%';

The expected results are "server_audit_filters" and "server_audit_users".

If "server_audit_filters" and "server_audit_users" are missing, this is a finding.

Identify users with global privileges that could modify audit configuration:

SELECT user, host, Insert_priv, Update_priv, Delete_priv, Drop_priv, Super_priv 
FROM mysql.user 
WHERE Insert_priv='Y' OR Update_priv='Y' 
OR 
Delete_priv='Y' OR Drop_priv='Y' OR Super_priv='Y';

If any non-ISSM-approved users have these privileges, this is a finding.

Identify users with privileges on the mysql database:

SELECT user, host, db, Insert_priv, Update_priv, Delete_priv, Drop_priv 
FROM mysql.db 
WHERE db='mysql' AND (Insert_priv='Y' OR Update_priv='Y' OR Delete_priv='Y' OR Drop_priv='Y');

If any non-ISSM-approved users have these privileges, this is a finding.

Identify users with table-level privileges on audit tables:

SELECT user, host, db, table_name, table_priv FROM mysql.tables_priv 
WHERE db='mysql' AND table_name IN ('server_audit_filters','server_audit_users') 
AND (table_priv LIKE '%Insert%' OR table_priv LIKE '%Update%' 
OR table_priv LIKE '%Delete%' OR table_priv LIKE '%Drop%');

If any non-ISSM-approved users have these privileges, this is a finding.

For each user and role identified above, verify effective privileges:

SHOW GRANTS FOR 'username'@'host';
SELECT user FROM mysql.user WHERE is_role='Y';
SHOW GRANTS FOR 'rolename';

If any user or role not designated by the ISSM has privileges allowing modification of "mysql.server_audit_filters", "mysql.server_audit_users", the mysql database, or audit-related global settings, this is a finding.