[Autogenerated] given us now.
An audit trail linking Uses to actions Requirement 10.2 now tells
you what set of actions taken by a user needs to be able to be
reconstructed from the audit trail.
This is actually a rare outcome based word of requirement in PC IDE CSS,
and it says that auditing must be enabled on all system
components to be able to reconstruct the specific events
detailed in the sub requirements, 10.2 point one through to 10.2 point seven.
It's really useful to pay careful attention to the wording here.
It does not say the auditing needs to be enabled for
every system component in the CD,
just those that are required to construct the specific events.
The testing procedure for all of the sub requirements is the same,
which is to verify, but what's specified is logged on the QoS.
A will do this by looking at the logs and talking to Sister Madman's.
So the first event that they spelled to be reconstructed from the
audit logs is individual access to cardholder data.
Next, any activities carried out by users with admin or root level access,
and rather recursive Lee access to audit trails because of,
of course,
criminals will want to cover up their malicious activity by
deleting records from the audit trails.
The next event that needs to be logged is invalid logical access attempts.
In other words,
where the user name and password didn't match so that you could look for people
trying to guess username or trying to brute force passwords.
Sub requirement 10.2 point five is slightly more involved,
and there are actually a few actions that need to be able to
be reconstruct from the logs in this one.
It's a tough requirement to decipher.
So first off is the use of identification authentication mechanisms,
so successful Loggins and details of what authentication we used to
validate that successful log in next in the sub requirement.
His changes to identification and authentication mechanisms.
So changes of username passwords for MF error requirements and
that must also include the creation of new accounts on any
elevation of account privileges.
And finally, anything that's done to root or admin accounts.
And yes,
if you're thinking that should have been three separate sub requirements,
it probably should.
Thankfully,
10.2 point six is much simpler which is another slightly
recursive sounding one that starting,
stopping or pausing audit logging needs to be logged.
It's not actually recursive because you'd write that the audit
log was stopped before it was stopped and are not trying to do it
afterwards once it was stopped on.
The final event that needs to be logged so it could
be reconstructed is quite vague,
and that's the creation deletion off system level objects.
Now.
I think this should also include the modification of system level objects,
which is clear.
The intent in the guidance on the question I know that you're asking yourself is
what on earth is a system level object and you're in luck?
Because that's actually a term do you find in the PC IDE CSS glossary on
who's the definition of the term and you can see it's a pretty broad
definition off anything the system needs to operate.
So it's the creation deletion of modification of
everything in the list you see in front of you,
and that's what needs to be written to the audit logs