1.1.10 Set 'aaa accounting system'

Information

Performs accounting for all system-level events not associated with users, such as reloads.

Authentication, authorization and accounting (AAA) systems provide an authoritative source for managing and monitoring access for devices. Centralizing control improves consistency of access control, the services that may be accessed once authenticated and accountability by tracking services accessed. Additionally, centralizing access control simplifies and reduces administrative costs of account provisioning and de-provisioning, especially when managing a large number of devices. AAA Accounting provides a management and audit trail for user and administrative sessions through RADIUS and TACACS+.

Solution

Configure AAA accounting system.

hostname(config)#aaa accounting system {default | list-name | guarantee-first}
{start-stop | stop-only | none} {radius | group group-name}

Impact:

Enabling aaa accounting system creates accounting records for all system-level events. Organizations should regular monitor these records for exceptions, remediate issues, and report findings regularly.

See Also

https://workbench.cisecurity.org/benchmarks/17130

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Cisco

Control ID: fcaf8e11c36fabee62038c33e2df72852e72c3d86d858c956e0488301a9e6f0f