- 11331(b) make following FISMA or NSTISSP mandatory
So, lets hop over to NIST 800-53:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf
Skip allllll the way to PDF pg 108, "Table D-2: Security Control
Baselines," and you'll see the Low/Mod/High impact levels and what
controls you have to meet at each one.
Relating to the CentOS discussion, the IA-7 controls are interesting.
They state:
> The information system implements mechanisms for authentication to a cryptographic
> module that meet the requirements of applicable federal laws, Executive Orders, directives,
> policies, regulations, standards, and guidance for such authentication
The "that meet requirements of applicable federal laws... policies..
standards" bit refers to FIPS 140-2 certification. Which CentOS doesn't
have.
Another goodie, SA-4(6), "Acquisition Process | Use of Information
Assurance Products", which reads:
...
And then SA-4(7), "Acquisition Process | NIAP-Approved Protection
Profiles," which reads:
But again, agencies must elect to follow these controls and standards.
DAAs can certainly waiver them -- and in the case of wherever CentOS is
being deployed -- they have (you're not running CentOS without the
knowledge of your CISO/DAA, right?).
CentOS isn't the devil, though. It provides a nice middleground between
bleeding-edge Fedora and 10yr stable RHEL. When it comes to government
systems though, I fail to see any place for CentOS.
And for those who argue "we don't need RHEL for just development!":
- Even development systems must follow Information Assurance guidelines
spoken about above. And ok, fine, internal environments at System
Integrators are not specifically called out for these regulations...
however many contracts do require integrators to follow the same
standards as government systems;
- CentOS isn't RHEL. If you dev/test on CentOS, you'll need to
completely retest on RHEL. Two different OS'
- If you throw out the economic argument ("it's just dev! i can't double
my RHEL costs for dev!"), then I'll gladly volunteer to find out who
your RHT Rep is... they'd love to work the economics out with you. And
besides, most RHEL subscriptions come with unlimited VMs per hypervisor
these days anyway. Doesn't care if it's dev/test/prod.