From jeremiah at goodinassociates.com Thu Aug 20 11:37:31 2015 Content-Type: multipart/mixed; boundary="===============2311068738918147841==" MIME-Version: 1.0 From: Jeremiah Jahn To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] Update C2S profile per request from CIS Date: Wed, 13 Aug 2014 07:17:54 -0500 Message-ID: In-Reply-To: 53EA6F76.2020601@redhat.com --===============2311068738918147841== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I was wondering about that. That 20K is a rather steep price. I always assumed that Redhat was part of CIS though. On Tue, Aug 12, 2014 at 2:48 PM, Shawn Wells wrote: > > On 8/12/14, 3:02 PM, Shawn Wells wrote: >> >> The prior wording of the C2S profile contained a statement that the C2S >> profile, >> as it is derived from CIS' publicly available RHEL6 Benchmark [1], >> could measure a system against the CIS RHEL6 baseline. >> >> We have been informed that per CIS' terms and conditions, specifically >> under >> RESTRICTIONS, item #8, one may not "represent or claim a particular level >> of >> compliance or consistency with any SB product." >> >> To remain in compliance with CIS' request, this patch updates the C2S >> profile >> description to indicate that while the C2S profile may be sourced from t= he >> public, >> freely available CIS benchmark, no representation or claim to a particul= ar >> level of compliance or consistency is being made. >> >> CIS is eager to collaborate more closely with the community (and Red Hat) >> on >> guidance development, in particular through the SCAP Security Guide. They >> have >> expressed that having automated security guidance and workflows ship with >> the Operating >> System is definitely a positive step, and one they encourage. >> Unfortunately, we were >> unable to reconcile the CIS Terms and Conditions to provide a freely >> available SCAP >> profile against the CIS baseline. When faced with the choice of paying >> ~$20,000 license fees [2], or rewording references to CIS compliance, the >> later was chosen. >> >> [1] >> https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Li= nux_6_Bench >> mark_v1.2.0.pdf >> [2] http://benchmarks.cisecurity.org/membership/certified/overview/ >> >> Signed-off-by: Shawn Wells >> --- >> RHEL/6/input/profiles/C2S.xml | 504 >> ++++++++++++++++++++--------------------- >> 1 files changed, 250 insertions(+), 254 deletions(-) >> >> diff --git a/RHEL/6/input/profiles/C2S.xml b/RHEL/6/input/profiles/C2S.x= ml >> index 282da6a..ef97fc2 100644 >> --- a/RHEL/6/input/profiles/C2S.xml >> +++ b/RHEL/6/input/profiles/C2S.xml >> @@ -1,19 +1,15 @@ >> >> C2S for Red Hat Enterprise Linux 6 >> This profile demonstrates compliance against the >> -U.S. Government C2S baseline. >> - >> -This baseline is tied to the Center for Internet Security's >> -Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013, >> -and uses the same refine values. One could use C2S interchangably >> -with CIS v1.2.0. For a copy of the CIS RHEL6 benchmark, refer >> -to: >> >> -https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_L= inux_6_Benchmark_v1.2.0.pdf >> - >> -This profile is not production ready and should be considered >> -development preview. As of 13-APR-2014, Out of the 233 >> -policy-mandated checks, only 169 currently have associated OVAL. >> -Patches would be most welcome! >> +U.S. Government Commercial Cloud Services (C2S) baseline. >> + >> +This baseline was inspired by the Center for Internet Security >> +(CIS) Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013. >> +For the SCAP Security Guide project to remain in compliance with >> +CIS' terms and conditions, specifically Restrictions(8), note >> +there is no representation or claim that the C2S profile will >> +ensure a system is in compliance or consistency with the CIS >> +baseline. >> >> >> @@ -26,698 +22,698 @@ Patches would be most welcome! >> >> - >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> > /> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> + >> >> - >> + >> >> - >> - >> + >> + >> >> - >> + >> >> >> - >> + >> >> - >> + >> >> - >> - >> + >> + >> >> >> - >> - >> + >> + >> >> - >> + >> >> - >> + >> >> - >> - >> + >> + >> >> - >> + >> >> - >> + >> >> - >> - >> + >> + >> >> - >> + >> >> - >> - >> - >> - >> + >> + >> + >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> - >> - >> + >> + >> + >> > selected=3D"true"/> >> > selected=3D"true"/> >> > selected=3D"true"/> >> > selected=3D"true"/> >> >> - >> + >> > selected=3D"true"/> >> - >> + >> + >> >> > /> >> >> - >> + >> >> - >> - >> + >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> >> - >> - >> + >> + >> + >> >> - >> + >> >> - >> + >> >> - >> - >> - >> + >> + >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> > /> >> >> - >> + >> >> - >> + >> >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> - >> - >> + >> + >> + >> >> >> >> - >> + >> >> - >> + >> >> - >> - >> + >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> >> - >> + >> - >> + >> >> >> - >> + >> >> - >> + >> >> >> >> >> >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> + >> >> - >> - >> + >> + >> - >> + >>