Ensure device security events are logged and forwarded to a central syslog/SIEM

Trung bìnhCấp 1Xem xét thủ côngprinter

Mô tả

Print devices keep only a small internal event log. Forwarding admin logins, configuration and firmware changes and failed authentications to syslog/SIEM lets compromise or misuse be detected and investigated.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Security / Networking > Syslog or Audit Log (HP: Security > Syslog / Event Log; Xerox: Security > Audit Log; Ricoh: Device Management > Logs): audit logging ON, syslog server set to the central collector (TLS syslog where supported), severity covering security/authentication events; the device NTP/time server is configured so timestamps are correct; confirm in the SIEM that events from the device's IP were received recently.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

EWS: enable the audit/security event log, configure the syslog destination (preferably TLS, tcp/6514), set NTP to the organisation time servers, and create a SIEM alert for admin logins, configuration changes and firmware updates.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: printerloggingmonitoring
Tham chiếu: CIS Multi-Function Device Benchmark v1.0.0 - Logging and auditing (verify section number for your release)