Appendix E_Audit Log Review Supplemental Implementation Guide.pdf
PDF 447 KB Posted
- Attached to
- ERP PPS DIBBS Modernization
- Solicitation number
- SP4701-25-I-4003
- Issued by
-
Defense Logistics Agency
About this file
This is a Supplemental Implementation Guide (ALRSIG) for Audit Log Review of the Defense Logistics Agency's (DLA) Enterprise Business System (EBS), version 2.2 dated July 11, 2023. The document outlines procedures and requirements for reviewing security audit logs in the EBS system, which is hosted in Amazon Web Services (AWS) and administered by NS2.
The guide details specific roles and responsibilities for security log review teams, including Security Analysts, Information System Security Managers (ISSM), and Program Management Office (PMO) personnel. It establishes 13 key audit review criteria focusing on events like escalated privileges, SAP_All access, unauthorized access attempts, user changes, and failed logons. The document includes comprehensive lists of privileged/elevated job roles and system identifiers (SIDs) for various EBS components like SAP Business Warehouse (PB1), Customer Relationship Management (PC1), and Enterprise Resource Planning (PR1). The guide also specifies that audit logs must be reviewed weekly, with logs retained in Cloudwatch storage for 30 days before moving to infrequent access storage for 180 days and then to Glacier long-term storage.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Appendix B - PPS and BFM 4.0 Relase RoadMap.pptx | PPTX presentation | |
| Appendix F_DLA_Auditing_Implementation_Guide_V3_20210208.pdf | ||
| Appendix C - EBS CM SIG.pdf | ||
| Appendix H DIBBS Requirements.xlsx | XLSX spreadsheet | |
| Appendix G PPS Notional Deployment Schedule.pdf | ||
| Appendix A PPS Product Backlog List_PBL.docx | DOCX document | |
| Appendix D_DLA Agile Playbook_Version 1.0 .pdf | ||
| DRAFT_PWS_PPS-11-12-2024.docx | DOCX document | |
| ERP PPS RFI.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Defense Logistics Agency (DLA)
Audit Log Review
SUPPLEMENTAL IMPLEMENTATION GUIDE (ALRSIG)
For
ENTERPRISE BUSINESS SYSTEM (EBS)
Version 2.2
July 11, 2023
Enterprise Business System (EBS) Audit Log Review Supplemental Implementation Guide
Page | 2 ALRSIG Template, Version 3.0
Approved By:
Kurtis Potts, Audit Logging eOPR Date Cybersecurity, J61 Defense Logistics Agency
Bradley A. Lantz, EBS Portfolio Manager Date J62E Defense Logistics Agency
Page | 3
DOCUMENT CHANGE/VERSION CONTROL
Date Reason for Change
Version to be Released Brief Description POC
Feb 2021 Version Update
This version standardizes the SIGs post J61 transition.
Suzie Fairley
March 2021 V 1.0 This version includes EBS program updates
Linda Abraham
July 2021 V 1.1 This version includes EBS program updates
Linda Abraham
June 2022 V 2.0 This version is compliant with DLA
AIG signed Nov 2021.
Program specific updates to include changes needed to reflect the migration of EBS to a new hosting environment and hosting provider.
Kurtis Potts Linda Abraham
January 2023 V2.1 Minor changes to the Asset listings – removing DB servers that were not part of DISA baseline and incorporating AIG template changes
Kurtis Potts Linda Abraham
July 2023 V2.2 Update 10.4, Temporary
Operational Issues
Kurtis Potts Linda Abraham
Page | 4
Table of Contents
INTRODUCTION AND PURPOSE
APPLICABILITY
REFERENCES
ROLES AND RESPONSIBILITIES
PROCEDURE
APPLICATION COMPONENTS
INFORMATION REQUIREMENTS
INTERNAL CONTROLS
LOG MANAGEMENT TOOLS
SECURITY AUDIT LOG REVIEW CRITERIA UPDATES
Identification Event Validation Changes to Review Criteria Temporary Operational Issues
RELEASABILITY
EFFECTIVE DATE
ENCLOSURE 1
EBS SECURITY LOG REVIEW PROCEDURES
ENCLOSURE 2
EBS SECURITY AUDIT LOG REVIEW CRITERIA
ENCLOSURE 3
EBS PRIVILEGED OR ELEVATED JOB ROLES
ENCLOSURE 4
AUDITABLE COMPONENTS – SYSTEM IDENTIFIER (SID)
Page | 5
INTRODUCTION AND PURPOSE
As a supplement to the DLA Auditing Implementation Guide (AIG), the information in this document provides a description of the auditing procedures and safeguards used to detect and report changes that could negatively affect confidentiality, integrity and availability of the EBS. As required by DLA SOP 8531.02-01, “DLA J6 Cyber Security Auditing and Monitoring” this document should be used when conducting EBS security audit log reviews. This document identifies key roles for security audit log review in EBS and their responsibilities with respect to auditing procedures.
The purpose of this document is to establish and prescribe a program level process for the implementation of security audit and logging management to comply with the DLA Auditing Implementation Guide, current version. This document describes the security audit log review procedures for the EBS. This is a living document that requires annual review and modification as required to implement effective security audit log review.
EBS is the Information Technology (IT) foundation that enables DLA to fully implement electronic business, web-based technologies, and an interoperable data environment for its logistics mission.
APPLICABILITY
This document identifies key roles and responsibilities with respect to application auditing procedures and supplements the DLA Auditing Implementation Guide.
This Supplemental Implementation Guide (SIG) applies to:
a. The EBS J62 Program Management Office (PMO) that is responsible for configuring application components to generate logs as described in the AIG and specific to the application as defined in this document. The PMO will coordinate any planned logging outages or changes to the auditing configuration that will impact the audit log review criteria, the audit log review process or compliancy with NIST 800-53v4 Risk Management Framework Audit and Accountability controls.
b. Security Analysts and designated security log reviewers (hereafter referred to as Security Analysts) responsible for application log review.
c. J611B Cybersecurity Information Systems Security Manager (ISSM), tasked with assisting the PMO with the development and implementation of Audit Logging and Accountability controls required in references 3.d and 3.e. The ISSM takes action to resolve potentially anomalous events identified during the log review process.
REFERENCES
a. DLA Auditing Implementation Guide, current version.
b. DLA CERT SOP 6400.3A, DLA Cyber Incident Handling Plan, current version.
c. J6 SOP 8531.02-01, DLA J6 Cyber Security Auditing and Monitoring, current version.
d. DODI 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT), March 12, 2014, http://www.esd.whs.mil/Directives/issuances/dodi/.
Page | 6
e. SP 800-137 Information Security Continuous Monitoring for Federal Information Systems and Organizations, Sep 2011, http://csrc.nist.gov/publications/nistpubs/800-137/SP800-137-Final.pdf.
f. EBS Security Concept Of Operations (CONOPS).
J62E EBS Portfolio Management - Security ConOps.pdf - All Documents (dps.mil)
g. J612A SharePoint site.
https://dlamil.dps.mil/teams/C27/N918/Lists/Application%20Log%20Review%20Transition%20Plan/AllIt ems.aspx.
h. eMASS – https://dla.emass.apps.mil/Public/SiteAgreement.
ROLES AND RESPONSIBILITIES
a. Roles: In order to maintain separation of duties, the Security Analysts will not have higher than user level access to applications under review. User level access may be required as part of being a normal DLA user (i.e., EAGLE).
b. The following table reflects the stakeholders in the log review process:
Security Log Review Team
Team Member Name
Application Job Role / Function
Security Analysts Tyler Ringhoffer Tyler.Ringhoffer@dla.mil Application Log
Analyst
Kurtis Potts Kurtis.Potts@dla.mil Application Log
Analyst
Primary ISSM Dan Gull Dan.Gull@dla.mil ISSM
Alternate ISSM Cybersecurity Team EBS_Cybersecurity@dla.mil Cybersecurity
Team
Yehudah (Hudy)
Griffin Yehudah.Griffin.ctr@dla.mil Cybersecurity
Arun Bhandari Arun.Bhandari.ctr@dla.mil Cybersecurity
Primary PMO Security Audit Log POC
Linda Abraham Linda.abraham@dla.mil PM
Alternate PMO Security Audit Log POC
Brandon Robrahn Brandon.robrahn@dla.mil EBS Impact Manager
Alternate PMO Security Audit Log POC
Service organization
SAPNS2: Mark Toms, mark.toms.ctr@dla.mil, 202-281-6729 EBS is hosted in the Amazon Web Services cloud and administered by
NS2. NS2 is responsible for configuring, maintaining, and making audit logs available to DLA Splunk. DLA is responsible for the review of the application logs
Incident Response DLA CERT, CERT@dla.mil, 614-692-9593 https://dlamil.dps.mil/sites/EBSPortfolioManagementJ62E/Enterprise%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FEBSPortfolioManagementJ62E%2FEnterprise%20Documents%2FEBS%20Portfolio%20Management%20Documents%2FSecurity%20ConOps%2Epdf&viewid=5a3f838e%2Dcf68%2D4952%2D8b8a%2Dd11c9f80bba1&parent=%2Fsites%2FEBSPortfolioManagementJ62E%2FEnterprise%20Documents%2FEBS%20Portfolio%20Management%20Documents https://dlamil.dps.mil/teams/C27/N918/Lists/Application%20Log%20Review%20Transition%20Plan/AllItems.aspx https://dlamil.dps.mil/teams/C27/N918/Lists/Application%20Log%20Review%20Transition%20Plan/AllItems.aspx mailto:Tyler.Ringhoffer@dla.mil mailto:Kurtis.Potts@dla.mil mailto:EBS_Cybersecurity@dla.mil mailto:Linda.abraham@dla.mil mailto:Brandon.robrahn@dla.mil mailto:mark.toms.ctr@dla.mil
Page | 7
Log Maintenance and
Support Enterprise Log Management, Cybersecurity.Enterprise.Log.Management@dla.mil
Enterprise Auditing and Accountability eOPR
Kurtis Potts, kurtis.potts@dla.mil, 614-692-9485
Table 1: Security Audit Log Review Team
c. Responsibilities:
1) Program Management Office:
a. Ensure audit logging is enabled and configured correctly on all application components in accordance with (IAW) reference 3.a.
b. Coordinate with the ISSM and service provider any planned audit log outages or changes to audit logging configurations to ensure the outages/changes do not impact the audit review and events and content generated that are required for compliancy with compliance with Risk Management Framework (RMF) Audit and Accountability (AU).
c. Identify application-specific event indicators and criteria for security audit log review.
d. Document application non-compliance with RMF AU controls in eMASS.
e. Ensure Service Now ticket is opened with NS2 when there are issues with Audit Log data.
2) Audit Logging Enterprise Office of Primary Responsibility (eOPR)
a. Ensure security audit log review processes identified in this ALRSIG are implemented.
b. For applications under the audit umbrella, assign primary and backup security analysts to conduct the security audit log review.
c. Ensure ALRSIG is reviewed annually.
3) Security Analyst
a. Review application security logs for anomalies that may lead to detection of unauthorized or malicious activities.
b. Document suspicious activities in the EBS Security Log Review Checklist.
c. Report any events suspected to be malicious or suspicious in nature to the ISSM.
d. Report operational technical issues and the resolution of the issues to the ISSM and PMO through the distribution of the Security Log Review Checklist.
mailto:Cybersecurity.Enterprise.Log.Management@dla.mil mailto:Cybersecurity.Enterprise.Log.Management@dla.mil
Page | 8
4) J611B Information System Security Manager
a. Ensure security controls related to auditing are assigned, implemented, and assessed in accordance with DOD and DLA assessment and authorization process guidance.
b. Review the EBS Security Log Review Checklist escalated from the J61 Security Analyst to assess for possible security-related incident.
c. Follow Incident Response procedures for review and escalation of anomalous events.
d. Document actions taken regarding anomalous events using the EBS Security Log Review Checklist and store in the application repository within 5 business days of review.
e. Inform the log review security analysts of planned audit logging outages or changes in audit logging configuration that may impact the audit log review process.
5) Service Provider
a. Ensure security controls related to auditing are assigned, implemented, and assessed in accordance with DOD and DLA assessment and authorization process guidance.
b. Monitor OS and other infrastructure security logs for anomalies that may lead to detection of unauthorized or malicious activities.
c. Report any events suspected to be malicious or suspicious in nature to the EBS ISSM and DLA
CERT.
d. Report operational technical issues and the resolution of the issues to the EBS ISSM, PMO, Security Analyst.
6) Security Center Of Excellence (SCOE) Office
a. Ensure Segregation of Duty security controls related to auditing are assigned, implemented, and assessed in accordance with DOD and DLA assessment and authorization process guidance.
b. Review critical function risks and report SoD posture to the EBS PMO on a periodic basis.
PROCEDURE
1) OVERVIEW: This ALRSIG describes the steps conducted by the Security Analyst when reviewing the application security audit logs, and documents appropriate actions that may be required.
2) DESCRIPTION: A summary of the steps taken are below. The detailed steps are in Enclosure 1 Security
Log Review Procedures.
a) Application security audit log review is under the purview of DLA unless otherwise specified.
b) AU eOPR will test the security audit log review process for operating system and database logs under contract support by business partners (i.e., DISA, Cloud environments, etc.) annually during OMB A- 123 testing. Evidential matter could be in the form of completed review documentation or the applicable audit System and Organization Controls (SOC) report.
Page | 9
c) Evidential Matter (EM) is uploaded to application storage repository (DACS-RM) located https://www.private.dacs.dla.mil/portal.
d) High level security audit log review process:
(a) Log reports are generated from the DLA Enterprise Log Management (ELM) System on a weekly basis for the designated review period.
(b) The Security Analyst conducts the review of the events collected in the logs based on criteria established by the application PMO.
(c) The results of the review are documented and escalated to the ISSM for appropriate action IAW with the application’s Incident Response Plan.
APPLICATION COMPONENTS
The EBS is a complex system consisting of many application components aka subsystems. The EBS production application components are managed by a hosting service provider (NS2) and the EBS Program is responsible for ensuring the application components are configured IAW NIST AU controls and the Audit eOPR tools.
EBS systems subject to audit are identified using the SAP System Identifier (SID). See Enclosure 4 for the list of EBS SIDs used to identify the specific IT Assets subject to Audit Log Review below.
Resp Org
Host Env Server Name IP Address OS/
Function Description SID
DLA AWS AWASPRPPE004 138.141.20.10 RHEL 8.1 AP
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE001 138.141.20.7 RHEL 8.1 CI
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE002 138.141.20.8 RHEL 8.1 AP
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE003 138.141.20.9 RHEL 8.1 AP
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE005 138.141.23.5 RHEL 8.1 AP
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE006 138.141.23.6 RHEL 8.1 AP
App.-Server for SAP Customer Relationship Management (CRM) PC1
DLA AWS AWASPRPPE020 138.141.20.22 RHEL 8.1 CI
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1
DLA AWS AWASPRPPE021 138.141.20.23 RHEL 8.1 AP
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1
DLA AWS AWASPRPPE022 138.141.20.24 RHEL 8.1 AP
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1
DLA AWS AWASPRPPE023 138.141.20.25 RHEL 8.1 AP
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1
DLA AWS AWASPRPPE024 138.141.23.10 RHEL 8.1 AP
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1 https://www.private.dacs.dla.mil/portal
Page | 10
Resp Org
Host Env Server Name IP Address OS/
Function Description SID
DLA AWS AWASPRPPE025 138.141.23.11 RHEL 8.1 AP
App Server for SAP Project Portfolio Management (xRPM / cProjects / cFolders) (PPM) PF1
DLA AWS AWASPRPPE071 138.141.20.65 RHEL 8.1 CI
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE072 138.141.20.66 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE073 138.141.20.67 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE074 138.141.20.68 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE075 138.141.20.69 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE076 138.141.20.70 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE077 138.141.20.71 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE078 138.141.20.72 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE079 138.141.23.28 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE080 138.141.23.29 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE081 138.141.23.30 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPE082 138.141.23.42 RHEL 8.1 AP
App.-Server for SAP Supplier Relationship Management (SRM) PG1
DLA AWS AWASPRPPD016 138.141.20.188 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD017 138.141.20.189 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD018 138.141.20.190 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD019 138.141.20.191 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD020 138.141.20.192 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD009 138.141.20.91 RHEL 8.1 CI
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD010 138.141.20.92 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD011 138.141.20.93 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD012 138.141.20.94 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD013 138.141.20.95 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD014 138.141.20.96 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPD015 138.141.20.97 RHEL 8.1 AP
App.-Server for SAP Business Warehouse PB1
DLA AWS AWASPRPPE039 138.141.20.45 RHEL 8.1 CI
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
Page | 11
Resp Org
Host Env Server Name IP Address OS/
Function Description SID
DLA AWS AWASPRPPE040 138.141.20.46 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE041 138.141.20.47 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE042 138.141.20.48 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE043 138.141.20.49 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE044 138.141.20.50 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE045 138.141.20.51 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE046 138.141.20.52 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE047 138.141.20.53 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE048 138.141.20.54 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE049 138.141.20.55 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE050 138.141.20.56 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE051 138.141.20.57 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE052 138.141.20.58 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE053 138.141.20.59 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE054 138.141.20.60 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE055 138.141.20.61 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE056 138.141.20.62 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE057 138.141.20.63 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE058 138.141.20.64 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE059 138.141.23.15 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE060 138.141.23.16 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE061 138.141.23.17 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE062 138.141.23.18 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE064 138.141.23.20 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE067 138.141.23.24 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE068 138.141.23.25 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE069 138.141.23.26 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
Page | 12
Resp Org
Host Env Server Name IP Address OS/
Function Description SID
DLA AWS AWASPRPPE063 138.141.23.38 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE065 138.141.23.39 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE066 138.141.23.40 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE070 138.141.23.41 RHEL 8.1 AP
App.-Server for SAP Enterprise Resource Planning (ERP) PR1
DLA AWS AWASPRPPE090 138.141.20.78 RHEL 8.1 CI
App Server for SAP Governance / Risk / Compliance (GRC) PL1
DLA AWS AWASPRPPE091 138.141.23.35 RHEL 8.1 AP
App Server for SAP Governance / Risk / Compliance (GRC) PL1
DLA AWS AWASPRPPE016 138.141.20.19 RHEL 8.1 CI
App.-Server for SAP Process Orchestration (AEX+BPM on Java only) PW1
DLA AWS AWASPRPPE017 138.141.20.20 RHEL 8.1 AP
App.-Server for SAP Process Orchestration (AEX+BPM on Java only) PW1
DLA AWS AWASPRPPE018 138.141.20.21 RHEL 8.1 AP
App.-Server for SAP Process Orchestration (AEX+BPM on Java only) PW1
DLA AWS AWASPRPPE019 138.141.23.9 RHEL 8.1 AP
App.-Server for SAP Process Orchestration (AEX+BPM on Java only) PW1
DLA AWS AWASPRPPE097 138.141.20.84 RHEL 8.1 CI SLT CI PLT
DLA AWS AWASPRPPE031 138.141.20.5 RHEL 8.4 CI
App-Server for SAP Solution Manager ABAP-7.2 PSM
DLA AWS AWASPRPPE037 138.141.20.35 PS1
DLA AWS AWASPRPPE038 138.141.20.36 RHEL 8.1 AP
App.-Server for SAP Supply Chain Management (SCM) PS1
DLA AWS AWASPRPPE033 138.141.20.37 RHEL 8.1 AP
App.-Server for SAP Supply Chain Management (SCM) PS1
DLA AWS AWASPRPPE034 138.141.20.38 RHEL 8.1 AP
App.-Server for SAP Supply Chain Management (SCM) PS1
DLA AWS AWASPRPPE035 138.141.23.13 RHEL 8.1 AP
App.-Server for SAP Supply Chain Management (SCM) PS1
DLA AWS AWASPRPPE036 138.141.23.14 RHEL 8.1 AP
App.-Server for SAP Supply Chain Management (SCM) PS1
INFORMATION REQUIREMENTS
The Enterprise Log Management (ELM) servers must be available in order for required application security audit logs to be generated. These logs are the basis for the audit log review process. The following documents are required to conduct the application log review:
a. ELM weekly report data.
1. DLA_AS_EBS-SAP AWS Detailed Audit Events.
b. EBS approved elevated/privileged users list; AMPS and/or other report.
c. EBS Security Log Review Checklist.
Page | 13
INTERNAL CONTROLS
To ensure SIG is followed, monthly testing IAW the DLA Internal Controls Program will be conducted to validate the application security audit log review is conducted on a weekly basis; anomalous activity is identified and escalated to the ISSM for investigation; and anomalous activity is tracked to resolution. EM will be generated and stored in the application repository to document all phases of the process.
LOG MANAGEMENT TOOLS
Tool Name Role of Tool Hosting Location and Version Number (optional)
Splunk Provides enterprise log management and correlation and analytics capabilities. DLA
GRC Provides enterprise Segregation of Duty control and reporting AWS MilCloud
AWS CloudTrail Provides OS and DB monitoring and reporting AWS MilCloud
Table 3: Log Management Tools
SECURITY AUDIT LOG REVIEW CRITERIA UPDATES
Identification
During the course of the weekly log review it may be discovered that updates to the review criteria or the check being conducted may be required. Updates can be required due to, but not limited to, the vetting of a previously identified potential anomaly, operational issues that impact the generation of the logs.
Event Validation
The ISSM will review potentially anomalous events identified during the log review process. The ISSM will take action to validate the identified activity and document the outcome on the EBS Security Log Review Checklist. Review criteria validated by the ISSM as being authorized (i.e., userID, event ID, etc.) will be added to the EBS Security Log Review Checklist for the appropriate checks to be used as valid criteria until such a time that the authoritative source of the information can be updated.
Changes to Review Criteria
Validated events that result in modifications or updates to event thresholds and review criteria identified in Enclosure 2 Security Audit Log Review Criteria will be documented and approved by the PM or a representative of the application PMO. The approved changes will be effective upon approval and incorporated into the EBS Security Log Review Checklist until the ALRSIG can be updated.
Page | 14
Temporary Operational Issues
When operational issues arise preventing log reviews from being completed, the EBS Security Log Review Checklist will be documented with the issue and what is being done to resolve the issue. An NS2 ServiceNow ticket will be submitted to document the operational issues and annotated on the EBS Security Log Review Checklist. If applicable, the ticket will request a resubmission of Audit Log data. When the issue is resolved, the missed reviews will be conducted and documented on a separate EBS Security Log Review Checklist for each of the missed log reviews.
a. In the event that EBS logs are not received by Splunk, an alert notification is set up to notify ELM Team if 0 events are received within a 24hr period. Other factors could contribute to an inquiry, such as a significant reduction in log events which could generate the need to troubleshoot and/or open a DLA ticket or NS2 Snow Ticket. The following actions will be taken for above situations:
1. Alert Notification or other factors
2. Perform initial troubleshooting to isolate the issue (e.g., Connection, Credential, Splunk
Ingestion, AWS S3 retrieval, NS2 related)
a. If Splunk Ingestion issue – Review Splunk AWS app and configuration files for issues
b. If AWS S3 retrieval issue – Check Splunk AWS app logs for error message
i. If Splunk app related, work to resolve issue
ii. If related to the S3, open NS2 SNOW ticket for them to resolve the issue
c. If NS2 related error – Open NS2 SNOW ticket and for them to resolve the issue on the AWS side (e.g., server side problems or relaying to S3 bucket)
d. If Connection issue – Open SNOW ticket and assign to proper group (e.g. network team, NS2, etc.
e. If Credential issue – Open SNOW ticket and assign to NS2 for resolution
3. Confirm receipt of missing logs and close SNOW ticket as necessary
b. EBS AWS/NS2 will retain log events in accordance with the following schedule and will make available in the event of transmission errors.
1. Application Audit Logs are available in Cloudwatch Short Term storage for 30 days.
2. Application Audit Logs are moved to Cloudwatch Infrequent storage after 30 and remain available in Cloudwatch storage for 180 days.
3. Application Audit Logs are moved to Glacier Long Term storage after 180 days.
RELEASABILITY
RESTRICTED. This SIG is approved for restricted release. It is available to users with Common Access Card authorization on the J6 SharePoint site.
EFFECTIVE DATE
This SIG is effective upon signature from J61 eOPR and J62 Program Manager and remains in effect until it is either superseded or cancelled.
Enclosures
(1) Security Log Review Procedures
(2) Security Audit Log Review Criteria
(3) Privileged or Elevated Job Roles
Page | 15
ENCLOSURE 1
EBS SECURITY LOG REVIEW PROCEDURES
1. The security audit logs are reviewed and the EBS Security Log Review Checklist escalated to the ISSM within seven (7) days from the receipt of the logs. The log reports are generated for the seven days prior. The range of logs are from Sunday thru Saturday.
2. Security Analysts receive system generated automated email notification from es.splunk@dla.mil informing that the EBS logs for the specific data range has been generated and available for download and review. The email notification will contain a URL to the logs.
3. Once the logs are downloaded, the Security Analyst will follow the Security Log Review Criteria listed in
Enclosure 2 Security Audit Log Review Criteria and complete the EBS Security Log Review Checklist.
A template for the Security Log Review Checklist is provided in Appendix E Audit Log Review Checklist Template of the DLA Auditing Implementation Guide.
4. The Security Analyst will complete all checks on the EBS Security Log Review Checklist and document the actions taken to execute the steps and the results of the check. If no anomalous events are identified, it should be stated so. The supporting documents used to complete the review, i.e., the privileged user report, will be attached to the completed checklist. The checklist will be digitally signed by the Security Analyst and forwarded to the ISSM for review and action.
5. Once the log review is completed, the results of the log review are summarized in the summary block of the checklist. If no anomalous events are identified, it should be stated so. The form is digitally signed by the Security Analyst. The signed form is forwarded to the ISSM for review and action.
6. The ISSM will conduct analysis on potentially anomalous events IAW the application Incident Response Plan. All potentially anomalous events will be tracked to resolution. The ISSM will maintain evidential matter of the final resolution of the anomalous event. The ISSM will advise the Security Analyst of any updates to the review criteria as a result of anomalous event resolution (i.e., new approved users, adjustments to thresholds, etc.).
7. Once the ISSM review is completed and signed by ISSM, the EBS Security Log Review Checklist is stored and maintained as Evidential Matter.
Page | 16
ENCLOSURE 2
EBS SECURITY AUDIT LOG REVIEW CRITERIA
Item Auditable Events Description Event Threshold Actions Taken
1 Escalated Privileges
Escalated Privileges (aka Limited Privileged Access) are tracked and approved in the GRC system
N/A
This event for the “Review Escalation of Privileges” is being reviewed within the Governance, Risk & Compliance (GRC) system which is a subcomponent of EBS.
Escalated privileges are tracked and approved in GRC. The EBS system does not have any users requiring “Review Escalation of Privileges”, therefore audit logs will not produce such events. This event is being annotated to comply with audit requirements.
SAP_All
Look for all Log on Messages containing SAP_All within both Critical and Important log events.
Any
AGR_REGENERATE_SAP
events
Filter column name “MESSAGE” and column name “PROGRAM” for AGR_REGENERATE_SAP and escalate to ISSM if any rows are returned
3 Successful Access to Objects by unexpected or unauthorized account
Review all successful accesses to the object and look for any unexpected or unauthorized account.
Any “Audit*” rows
Filter column name “MESSAGE” for “Audit*”. If rows are returned, log into checklist and escalate to ISSM.
Note: these events are provided to ISSM for review/situational awareness.
4 Authorization for User Changed
Look for Authorization for User Changed messages within the logs and to ensure that only authorized users conducted activities
Changes made by Authorized Users only
Filter column name “MESSAGE” for Authorization for User Changed. If any rows are returned, filter column name “Source User Name” to review list of users and verify against Authorized User List
5 Downloaded Bytes Look for Download
Bytes to File events within the logs and compare downloaded activities for users
N/A
Filter column name “MESSAGE” for Download Bytes for Tile. Filter column name “Total” and select top 10 instances. Copy instances to new tab. Note: these events are provided to ISSM for review/situational awareness
6 Failed RFC Call &
RFD/CPIC
logon failed
Look for Failed RFC Call* and RFC/CPIC logon failed events and to monitor and compare number of events > 5,000 event per day
>5000 events per day
Filter column name “MESSAGE” for “Failed RFC Call*” and “RFC/CPIC logon failed” events. Filter column name “Total” for event >5000. If rows are returned copy to new tab and escalate to ISSM
7 Logon failed Look for Logon failed events (exclude RFC/CPIC logon failed) with the logs
>2000 events
Filter column name “MESSAGE” for “Logon failed’ events (exclude RFC/CPIC logon failed). Filter column name “Total” for events
Page | 17
Item Auditable Events Description Event Threshold Actions Taken and to monitor and compare the number of such events > 2,000
>2000. Filter column name “Destination User Name”, unselect SAP*. If rows are returned copy to new tab and escalate to ISSM
8 User Created by Authorized Users Look for new users that were created by authorized users
Changes made by Authorized Users only
Filter column name “MESSAGE” for “User* Created” events. Review column name “Source User Name” for user listed. If Column name “Source User Name” lists unauthorized users, Escalate unauthorized users to ISSM
9 User Deleted by Authorized User
Look for authorized users that made changes to delete a user
Changes made by Authorized Users only
Filter column name “MESSAGE” for “User* Deleted” events. Review column name “Source User Name” for user listed. If Column name “Source User Name” lists unauthorized users, Escalate unauthorized users to ISSM
10 User Locked by Authorized User Look for authorized users that made changes to lock a user
Changes made by Authorized Users only
Filter column name “MESSAGE” for “User*Locked” events. Review column name “Source User Name” for user listed. If Column name “Source User Name” lists unauthorized users, Escalate unauthorized users to ISSM
11 User Locked in Client After Erroneous Password Checks
Look for Locked in Client After Erroneous Password Checks to monitor and compare users that are locked out client > 3
>3 events
Filter column name “MESSAGE” for User Locked in Client After Erroneous Password Checks (search for “Erroneous). Filter column name “Total” for event >3.
Review column name “Source User Name” to view Source Name. If no Source Name, log event >3 and create new tab. Escalate events containing Source Name and >3 to
ISSM.
12 User Master Record Change by Authorized User
Look for authorized users that made changes to the master record
Changes made by Authorized Users only
Filter column name “MESSAGE” for “User Master Record* Changed” events. Review column name “Source User Name” for user listed.
If column name “Source User Name” lists unauthorized users and the column name “Destination User Name” does not match (same user), Escalate unauthorized users to ISSM
13 User Unlocked by Authorized User
Look for User Unlocked events to check that only authorized users unlocked user accounts
Changes made by Authorized Users only
Filter column name “MESSAGE” for User* Unlocked events. Review column name “Source User Name” for user listed. If Column name “Source User Name” lists unauthorized users, Escalate unauthorized users to ISSM
Page | 18
ENCLOSURE 3
EBS PRIVILEGED OR ELEVATED JOB ROLES
The EBS Privileged or Elevated Job Roles are documented in the EBS Access Control Plan. The list of EBS Privileged/Elevated Job Roles is used by the Audit eOPR in the Audit Log review process. Changes to the EBS Privileged/Elevated job roles must be provided to the Audit eOPR.
Privileged Users:
Table 4a: Privileged or Elevated Job Roles
Limited Privileged Users:
Job Description
Environment Role Name IT Level
JD-00069 EBS Production e Gate eAI EDI Programming X-12 Specialist
IT1
JD-00074 EBS Production Planning Technical Specialist Profile IT1 JD-00076 EBS Production Security Production Support IT1 JD-00077 EBS Production SAP Basis Administrator IT1 JD-00078 EBS Production Security Administrator IT1 JD-00079 EBS Production Database Administrator IT1 JD-00080 EBS Production SAP Release Management IT1 JD-00082 EBS Production Portal Administrator IT1 JD-00085 EBS Production Manugistics Administrator IT1 JD-00124 EBS Production SAP Archiving IT1
Enterprise App Application Role Name Role IT Level
DLA Enterprise Business System ()
Production
Prod - Enterprise Help Desk Technician - Level 1 JD-00526
IT2
Prod - Service Desk Agent (DISA Ogden Employees Only) JD-00456
IT2
Prod - Production Application Security Administrator - DISA Ogden Employees Only JD-00455
IT1
Prod - Production Application Support (DISA Ogden Employees Only) JD- 00438
Prod - Production Application Support (NS2 Employees Only) JD-00439
Page | 19
Job Description
Environment Role Name IT Level
JD-00252 EBS Production Procurement Tech Ops Support Administrator
IT1
JD-00253 EBS Production Procurement BOSO Tech Ops Support IT1 JD-00254 EBS Production DIBBS PACE ECF Unix Developer IT1 JD-00256 EBS Production DIBBS PACE ECF NT Web Dev IT1 JD-00378 EBS Production Sustainment Technology Administrator IT1 JD-00419 EBS Production Big Data Admin IT1 JD-00438 EBS Production Production Application Support (DISA
Ogden Employees Only)
IT1
JD-00439 EBS Production Application Managed Services IT1 JD-00455 EBS Production Production Application Security
Administrator - DISA Ogden Employees Only
IT1
JD-03002 EBS Production Production Support Firefighter Application Security Analyst
IT1
JD-03003 EBS Production Production Support Firefighter Application Security Lead
IT1
JD-03014 EBS Production Production Support Firefighter Basis Analyst
IT1
JD-03015 EBS Production Production Support Firefighter Basis Lead
IT1
JD-10030 EBS Production BW View Analyst Bolt On Role IT1 JD-10069 EBS Production Manugistics What If Administrator Bolt
On Role
Table 4b: EBS Limited Privileged or Elevated Job Roles
Page | 20
ENCLOSURE 4
AUDITABLE COMPONENTS – SYSTEM IDENTIFIER (SID)
SAP SID is three-digit unique identification code in a specific server. No special instructions to name the SID except SID should be three characters and SID should be in uppercase. A system in EBS can consist of one or more servers. The following list of SIDs are used to identify the financial relevant systems and associated servers subject to audit log review and for which audit log reporting must be configured.
SID Description PB1 SAP Business Warehouse PC1 AP Customer Service Management (CRM) PF1 Product Lifecycle Management (PLM) cFolders PG1 SAP Supplier Relationship Management (SRM) PL1 SAP Governance, Risk, and Compliance (GRC)
PLT SAP SLT
PR1 SAP Enterprise Resource Planning (ERP aka ECC) PS1 SAP Supply Chain Management (SCM) PSM SAP Solution Manager - ABAP PW1 Process Orchestration – Replaced PY1 Process
Integration during migration
| 1.0 INTRODUCTION AND PURPOSE |
| 2.0 APPLICABILITY |
| 3.0 REFERENCES |
| 4.0 ROLES AND RESPONSIBILITIES |
| 5.0 PROCEDURE |
| 6.0 APPLICATION COMPONENTS |
| 7.0 INFORMATION REQUIREMENTS |
| 8.0 INTERNAL CONTROLS |
| 9.0 LOG MANAGEMENT TOOLS |
| 10.0 SECURITY AUDIT LOG REVIEW CRITERIA UPDATES |
| 10.1 Identification |
| 10.2 Event Validation |
| 10.3 Changes to Review Criteria |
| 10.4 Temporary Operational Issues |
| 11.0 RELEASABILITY |
| 12.0 EFFECTIVE DATE |
| ENCLOSURE 1 |
| EBS SECURITY LOG REVIEW PROCEDURES |
| ENCLOSURE 2 |
| EBS SECURITY AUDIT LOG REVIEW CRITERIA |
| ENCLOSURE 3 |
| EBS PRIVILEGED OR ELEVATED JOB ROLES |
| ENCLOSURE 4 |
| AUDITABLE COMPONENTS – SYSTEM IDENTIFIER (SID) |
| 2023-07-11T15:46:29-0400 | |
| POTTS.KURTIS.D.1054044000 |
| 2023-07-12T08:01:14-0400 | |
| LANTZ.BRADLEY.A.1230112840 |
File details come from the government source that posted it. Updated .