documentation_complete: true

title: 'Ensure Log Files Are Only Accessed By Authorized Users'

description: 'Only authorized personnel may view log files.'

rationale: |-
    If the application provides too much information in error logs and
    administrative messages to the screen, this could lead to compromise.
    The structure and content of error messages need to be carefully considered
    by the organization and development team. The extent to which the
    information system is able to identify and handle error conditions is
    guided by organizational policy and operational requirements.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: ""

ocil_clause: 'log files can be accessed or viewed by any user'
