Conformance Statement

The following XDAS implementation conformance categories are defined:

• Basic XDAS Conformance
  This is applicable to an implementation of XDAS that supports the Common Audit Record Format and the Audit Read API in support of Audit Trail Analysis Applications. All implementations shall comply with this basic conformance criteria.

• XDAS Import API Option Conformance
  This is applicable to an implementation of XDAS that supports the Audit Log Import API.

• XDAS Event Submission API Option Conformance
  This is applicable to an implementation of XDAS that supports the Audit Event Service Client API for direct use by applications.

• XDAS Filter Management API Option Conformance
  This is applicable to an implementation of XDAS that supports a filtering capability and the Audit Event Management API.

Note:

Early implementations are expected to be by vendors with existing audit functionality who will probably limit their scope to Basic XDAS Conformance and XDAS Import API Conformance to provide support for the common audit record format.

Basic XDAS Conformance

XDAS Import API Option Conformance

XDAS Event Submission API Option Conformance

XDAS Filter Management API Option Conformance

Requirements on an Implementation

• An implementor is required to describe the basis on which, and the extent to which, the authorization model defined within XDAS is implemented and how the user assigns XDAS authorizations to callers. For example, an early implementation may restrict itself to mapping all XDAS authorizations to UNIX superuser privilege.

• An XDAS implementation shall not hinder the achievement of adequate performance over the network.

• An XDAS implementation shall utilize trustworthy universal timestamps on event records if available. Because the XDAS cannot assume a trusted time service is available, provision is included within the XDAS audit record format to include a measure of the uncertainty of the time at which the recorded event occurred. This uncertainty information needs to be inserted into the records when they are imported to or exchanged between XDAS systems.

• An implementor is required to state if the audit IDs are distinguished from access IDs and principal IDs.

• An implementor is required to document how additional registered audit event numbers are configured into an XDAS service.

• An implementation of the XDAS needs to meet the following security requirements:

  • Prevent unauthorized recording of audit event records

  • Prevent unauthorized modification of the audit service configuration data.

  • Prevent unauthorized modification of the event detection records.

  • Prevent unauthorized disclosure of the event records.

  • Support adequate separation of duties for users.

  • Provide appropriate measures in dealing with an unauthorized denial of service, for example, by suspending an offending process, if appropriate.

  • Protect audit service configuration data.

  • Protect the audit log and its contents from any unauthorized modification or deletions.

  • Protect the audit log by making it accessible only to principals acting in specific administrative or security roles.

  The security requirements shall be met by using underlying distributed system security services and platform security services, wherever possible.