Her Majesty’s Government (HMG) Information Assurance (IA) practitioners will have Protective Monitoring obligations, already laid down in national IA policy and HMG IA Standard No. 1 & 2 supplement.
The Good Practice Guide was developed to provide guidance on meeting these obligations. Further details are supplied by the NCSC.
To help assist those with Protective Monitoring obligations, we have created this page to outline which portion of SFTPPlus functionality applies to a Protective Monitoring Control.
As mentioned in the Guide, organisations are reminded that any particular Protective Monitoring product or service is subject to some form of independent assurance plus extensive acceptance testing by the business.
Example log of a file being processed details the timestamp of these actions:
20182 2017-01-30 11:56:41 Process user 127.0.0.1:50568 Account “jan” logged in.40007 2017-01-30 11:56:41 Process user 127.0.0.1:50568 HTTP/HTTPS file access successfully started in “/Operations/jan” as “/”.40021 2017-01-30 11:56:41 Process user 127.0.0.1:50568 File opened for upload at “/Reports/February-2017-Report.PDF”.40017 2017-01-30 11:56:41 Process user 127.0.0.1:50568 Successfully uploaded file at “/Reports/February-2017-Report.PDF”.
As this PMC relates to network activity at the boundary with a view to detecting suspect activity, this is more related to activities outside the scope of the software such as boundary firewalls.
Examples of such changes include:
An example of an unsuccessful OS authentication attempt is below:
20136 2016-11-17 09:31:55 Process Unknown 127.0.0.1:49569 Account “alice” forbidden by os authentication “Operating System Accounts” using “password” Credentials denied
Even if the data communicated over those connections is not a file transfer protocol, this activity is logged. For example, an SSH connection attempt is recorded as seen in the logs for the PMC-7 section.
Each network connection is uniquely identified using the source IP and port. This information will be associated to any actions logged for the activity by a connection.
Once a connection is successfully authenticated, the authenticated account is associated with any action done by that connection as long as the connection continues being authenticated.
An example of such activity is below:
30014 2017-01-17 11:56:42 Process Unknown 127.0.0.1:50568 New SSH connection made.20137 2017-01-17 11:56:42 single-server-uuid 127.0.0.1:50568 Account “eric” of type “os” authenticated as “eric” by os authentication “Operating System Accounts” using ssh-key.20182 2017-01-17 11:56:42 Process user 127.0.0.1:50568 Account “eric” logged in.30011 2017-01-17 11:56:42 Process user 127.0.0.1:50568 SFTP subsystem successfully started in “/Operations/eric” as “/”.30060 2017-01-17 11:56:42 Process user 127.0.0.1:50568 Canonical file name requested for ”.”.30019 2017-01-17 11:56:43 Process user 127.0.0.1:50568 Listing folder “/” 30020 2017-01-17 11:56:43 Process user 127.0.0.1:50568 Successfully listed folder “/”.
Currently there no option to remove/clean log entries stored in a database from within the SFTPPlus software. More details about the audit trail at the event handlers page.
One thing to note is that if log rotation is not enabled, the log file can grow to an extremely large size. Log rotation can be enabled in this scenario. When log rotation is enabled, there is the value to keep all rotated files via rotate_count in the event handlers page.
For example, when a connection fails the authentication step for an event with ID 20078 is created in the log system. Use an email notification event handler to send emails each time an event with ID 20078 is created by the log/audit system.
Further details in the email notifications page.
For example, if there is a failure to start logging, the details are in stdout:
27.0.0.1:64175 Failed to get logs data since database “mysql-db-uuid” is not started.
When an email notification is setup but there is a misconfiguration to the email-client resource, this is also logged. The example below is for an event ID 20076, which triggered an email notification but led to an error:
20174 2017-01-29 20:20:05 log-email-handler Process 127.0.0.1:0 Failed to handle event 20076 by “Log Email Handler”. User timeout caused connection failure.