Insufficient data authenticity validation - Cloudtrail Logs
Description
One or more Cloudtrail instances do not enable the EnableLogFileValidation attribute avoiding the integrity validation to be performed. This practice could aid an attacker to inject malicious information in log files without raising any alert.
Impact
Alterate the system logs integrity without raising alerts.
Recommendation
Set the EnableLogFileValidation attribute in true for all Cloudtrail instances.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⏱️ 15 minutes.
Requirements
080 - Prevent log modificationFixes
Score
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
Attack vector
N
Attack complexity
H
Attack requirements
N
Privileges required
L
User interaction
N
Confidentiality (VC)
N
Integrity (VI)
L
Availability (VA)
N
Confidentiality (SC)
N
Integrity (SI)
N
Availability (SA)
N
Threat 4.0
Exploit maturity
P
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P