`SI-11` Error Handling

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded SI Moderate baseline High baseline

Title

Error Handling

Control

a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and
b. Reveal error messages only to [Assignment: personnel or roles].

Discussion

Organizations consider the structure and content of error messages. The extent to which systems can handle error conditions is guided and informed by organizational policy and operational requirements. Exploitable information includes stack traces and implementation details; erroneous logon attempts with passwords mistakenly entered as the username; mission or business information that can be derived from, if not stated explicitly by, the information recorded; and personally identifiable information, such as account numbers, social security numbers, and credit card numbers. Error messages may also provide a covert channel for transmitting information.

Parameters

si-11_odp: personnel or roles

Related controls

au-2, au-3, sc-31, si-15, si-2

STIG rules that implement this control 70

Apple macOS 15 (Sequoia) V1R8

APPL-15-002021 CAT II The macOS system must disable sending diagnostic and usage data to Apple.
APPL-15-004001 CAT II The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.
APPL-15-004002 CAT II The macOS system must configure Apple System Log (ASL) files to mode 640 or less permissive.
APPL-15-004030 CAT II The macOS system must configure system log files owned by root and group to wheel.
APPL-15-004040 CAT II The macOS system must configure system log files to mode 640 or less permissive.

Apple macOS 26 (Tahoe) V1R4

APPL-26-002021 CAT II The macOS system must disable sending diagnostic and usage data to Apple.
APPL-26-004001 CAT II The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.
APPL-26-004002 CAT II The macOS system must configure Apple System Log (ASL) files to mode 640 or less permissive.
APPL-26-004030 CAT II The macOS system must configure system log files owned by root and group to wheel.
APPL-26-004040 CAT II The macOS system must configure system log files to mode 640 or less permissive.

Application Security and Development V6R5

APSC-DV-002570 CAT II The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
APSC-DV-002580 CAT II The application must reveal error messages only to the ISSO, ISSM, or SA.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-232025 CAT II Ubuntu 22.04 LTS must configure the "/var/log" directory to have mode "755" or less permissive.
UBTU-22-232026 CAT II Ubuntu 22.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
UBTU-22-232027 CAT II Ubuntu 22.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.
UBTU-22-232030 CAT II Ubuntu 22.04 LTS must configure "/var/log/syslog" file with mode "640" or less permissive.
UBTU-22-232080 CAT II Ubuntu 22.04 LTS must configure the directories used by the system journal to be owned by "root".
UBTU-22-232085 CAT II Ubuntu 22.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal".
UBTU-22-232090 CAT II Ubuntu 22.04 LTS must configure the files used by the system journal to be owned by "root".
UBTU-22-232095 CAT II Ubuntu 22.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal".
UBTU-22-232100 CAT II Ubuntu 22.04 LTS must be configured so that the "journalctl" command is owned by "root".
UBTU-22-232105 CAT II Ubuntu 22.04 LTS must be configured so that the "journalctl" command is group-owned by "root".
UBTU-22-232120 CAT II Ubuntu 22.04 LTS must configure the "/var/log" directory to be owned by "root".
UBTU-22-232125 CAT II Ubuntu 22.04 LTS must configure the "/var/log" directory to be group-owned by "syslog".
UBTU-22-232130 CAT II Ubuntu 22.04 LTS must configure "/var/log/syslog" file to be owned by "syslog".
UBTU-22-232135 CAT II Ubuntu 22.04 LTS must configure the "/var/log/syslog" file to be group-owned by "adm".
UBTU-22-232140 CAT II Ubuntu 22.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-700010 CAT II Ubuntu 24.04 LTS must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
UBTU-24-700020 CAT II Ubuntu 24.04 LTS must generate system journal entries without revealing information that could be exploited by adversaries.
UBTU-24-700030 CAT II Ubuntu 24.04 LTS must be configured so that the "journalctl" command is not accessible by unauthorized users.
UBTU-24-700040 CAT II Ubuntu 24.04 LTS must be configured so that the "journalctl" command is owned by "root".
UBTU-24-700050 CAT II Ubuntu 24.04 LTS must be configured so that the "journalctl" command is group-owned by "root".
UBTU-24-700060 CAT II Ubuntu 24.04 LTS must configure the directories used by the system journal to be group-owned by "systemd-journal".
UBTU-24-700070 CAT II Ubuntu 24.04 LTS must configure the files used by the system journal to be group-owned by "systemd-journal".
UBTU-24-700080 CAT II Ubuntu 24.04 LTS must configure the directories used by the system journal to be owned by "root".
UBTU-24-700090 CAT II Ubuntu 24.04 LTS must configure the files used by the system journal to be owned by "root"
UBTU-24-700100 CAT II Ubuntu 24.04 LTS must configure the /var/log directory to be group-owned by syslog.
UBTU-24-700110 CAT II Ubuntu 24.04 LTS must configure the /var/log directory to be owned by root.
UBTU-24-700120 CAT II Ubuntu 24.04 LTS must configure the /var/log directory to have mode "0755" or less permissive.
UBTU-24-700130 CAT II Ubuntu 24.04 LTS must configure the /var/log/syslog file to be group-owned by adm.
UBTU-24-700140 CAT II Ubuntu 24.04 LTS must configure /var/log/syslog file to be owned by syslog.
UBTU-24-700150 CAT II Ubuntu 24.04 LTS must configure /var/log/syslog file with mode "0640" or less permissive.

Google Chrome Current Windows V2R11

DTBC-0068 CAT III Chrome development tools must be disabled.

Microsoft Windows 11 V2R11

WN11-AU-000035 CAT II The system must be configured to audit Account Management - User Account Management failures.
WN11-CC-000205 CAT II Windows Telemetry must not be configured to Full.

Microsoft Windows Server 2022 V2R11

WN22-00-000030 CAT I Windows Server 2022 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
WN22-DC-000070 CAT I Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.

Microsoft Windows Server 2025 V1R4

WN25-00-000030 CAT I Windows Server 2025 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
WN25-DC-000070 CAT I Windows Server 2025 permissions on the Active Directory data files must only allow system administrators (SAs) access.

Mozilla Firefox V6R9

FFOX-00-000015 CAT III Firefox development tools must be disabled.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-400080 CAT II RHEL 10 must be configured so that the "/var/log" directory is owned by "root".
RHEL-10-400085 CAT II RHEL 10 must be configured so that the "/var/log" directory is group-owned by "root".
RHEL-10-400090 CAT II RHEL 10 must be configured so that the "/var/log/"messages file is owned by root.
RHEL-10-400095 CAT II RHEL 10 must be configured so that the "/var/log/messages" file is group-owned by "root".
RHEL-10-400165 CAT II RHEL 10 must enforce group ownership of audit logs by "root" or by a restricted logging group to prevent unauthorized read access.
RHEL-10-400170 CAT II RHEL 10 must enforce "root" ownership of the audit log directory to prevent unauthorized read access.
RHEL-10-400175 CAT II RHEL 10 must enforce "root" ownership of audit logs to prevent unauthorized access.
RHEL-10-400180 CAT II RHEL 10 must enforce group ownership by "root" or a restricted logging group for audit log files to prevent unauthorized access.
RHEL-10-400185 CAT II RHEL 10 must set mode "0600" or less permissive for the audit logs file to prevent unauthorized access to the audit log.
RHEL-10-400220 CAT II RHEL 10 must enforce mode "0755" or less permissive for the "/var/log" directory.
RHEL-10-400225 CAT II RHEL 10 must enforce mode "0640" or less permissive for the "/var/log/messages" file.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-232025 CAT II RHEL 9 /var/log directory must have mode 0755 or less permissive.
RHEL-09-232030 CAT II RHEL 9 /var/log/messages file must have mode 0640 or less permissive.
RHEL-09-232170 CAT II RHEL 9 /var/log directory must be owned by root.
RHEL-09-232175 CAT II RHEL 9 /var/log directory must be group-owned by root.
RHEL-09-232180 CAT II RHEL 9 /var/log/messages file must be owned by root.
RHEL-09-232185 CAT II RHEL 9 /var/log/messages file must be group-owned by root.
RHEL-09-653080 CAT II RHEL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.
RHEL-09-653085 CAT II RHEL 9 audit log directory must be owned by root to prevent unauthorized read access.
RHEL-09-653090 CAT II RHEL 9 audit logs file must have mode 0600 or less permissive to prevent unauthorized access to the audit log.

SI-11 Error Handling