RE: Any rumors on next draft for RHEL 8 STIG from DISA?
by Todd, Charles
Or the FIPS 140-2/3 and CC certifications? They seem to be stuck in limbo too.
Charlie Todd
Ball Aerospace & Technologies
From: Hayden,Robert <RHAYDEN(a)CERNER.COM>
Sent: Wednesday, December 2, 2020 12:12 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: [EXTERNAL] Any rumors on next draft for RHEL 8 STIG from DISA?
Curious on if anyone has any information on the next draft release from DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did not really match where the current upstream was moving towards.
Thanks in advance
Robert
Robert Hayden | Lead Technology Architect | Cerner Corporation
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
This message and any enclosures are intended only for the addressee. Please
notify the sender by email if you are not the intended recipient. If you are
not the intended recipient, you may not use, copy, disclose, or distribute this
message or its contents or enclosures to any other person and any such actions
may be unlawful. Ball reserves the right to monitor and review all messages
and enclosures sent to or from this email address.
2 years, 10 months
Collecting system info with SCAP rules for manual inspection -
informational rules
by Watson Sato
Hello all,
Most of the Rules implemented in ComplianceAsCode/content
<https://github.com/ComplianceAsCode/content> (if not all of them) have
been focused on checking and remediating a specific configuration.
Typically configurations that are easy to automate.
For example, ensuring that packages installed have the signature verified
is implemented by a rule checking that the repo files have "gpgcheck = 1".
But there are cases where automation is not reasonably achievable, they
would require hard coding parameters or an extensive tailoring harness for
the rule.
For example, how to ensure that configured repositories are the ones
officially supported by the distro.
In these cases the check needs to be done by some other process, maybe
manually checking the repositories enabled, or some administrative process
guarantees it.
I don't know details of the auditory nor how these non-automatable
requirements are handled.
So I wonder if an Informational Rule that would collect the data for manual
analysis would be of help.
Following the examples, this informational rule would collect the list of
repositories enabled, and present it / aggregate it somehow.
Regards,
--
Watson Sato
Software Engineer
Red Hat EMEA <https://www.redhat.com>
<https://www.redhat.com>
2 years, 10 months
Re: Any rumors on next draft for RHEL 8 STIG from DISA?
by Ted Brunell
I cannot really talk much about CC and FIPS, but the STIG is expected to be
published by DISA (based on the draft STIG content on RHEL 8.2 and 8.3)
sometime early next year.
DISA may be able to provide a more concise timeframe. (
disa.stig_spt(a)mail.mil).
R/
Ted Brunell
On Wed, Dec 2, 2020 at 12:14 PM Hayden,Robert <RHAYDEN(a)cerner.com> wrote:
> Curious on if anyone has any information on the next draft release from
> DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did
> not really match where the current upstream was moving towards.
>
>
>
> Thanks in advance
>
> Robert
>
>
>
> *Robert Hayden* | Lead Technology Architect | Cerner Corporation
>
>
>
>
> CONFIDENTIALITY NOTICE This message and any included attachments are from
> Cerner Corporation and are intended only for the addressee. The information
> contained in this message is confidential and may constitute inside or
> non-public information under international, federal, or state securities
> laws. Unauthorized forwarding, printing, copying, distribution, or use of
> such information is strictly prohibited and may be unlawful. If you are not
> the addressee, please promptly delete this message and notify the sender of
> the delivery error by e-mail or you may call Cerner's corporate offices in
> Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
> _______________________________________________
> scap-security-guide mailing list --
> scap-security-guide(a)lists.fedorahosted.org
> To unsubscribe send an email to
> scap-security-guide-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
>
2 years, 10 months
Any rumors on next draft for RHEL 8 STIG from DISA?
by Hayden,Robert
Curious on if anyone has any information on the next draft release from DISA on RHEL 8 STIG benchmarks? The one in May was pretty rough and did not really match where the current upstream was moving towards.
Thanks in advance
Robert
Robert Hayden | Lead Technology Architect | Cerner Corporation
CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.
2 years, 12 months