On 6/4/13 1:43 PM, Nunez, Luis K wrote:
Another way to look at the remediation strategy is to have an
independent source for building fix content. The source would provide
basic information needed to change a system to a secure state. This
information would reside alongside the check information in the XCCDF
policy. Having a common source will help in achieving consistency in
remedial actions performed by differing scripting languages or fix
systems .
This method could also be used as a way to check parity in the
checking and fixing content for correctness.
This is probably a good time to review Common Remediation Enumeration
and see if fits into the project objective. CRE was created to
identify and provide a reference point for actions necessary to
correct a security issue. Based on the CRE-ID one could build
remediation scripts and systems in a referenced way. The CRE-ID could
also be used for traceability in troubleshooting and change control
management.
Reviewed the examples @
http://scap.nist.gov/specifications/cre/1.0/cre_examples.xml
And then the spec @
http://scap.nist.gov/specifications/cre/1.0/cre_1.0-draft.xsd
Seems like this would be a major schema change, requiring updates to
every rule, but I don't particularly see the value. Maybe it's just me
being dense =/
Seems like an interesting approach to have XCCDF express "requirements,"
OVAL to check system state, <fix> tags for automated compliance, then
CRE for manual remediation. From what I gather, the CRE really is a
different way to express SSG's usage of OCIL tags. Can you help explain
what value would be gained by changing content to CRE?