+1 to Shawn on this.
I joined the CIS community some time in the past but drifted away when I
realized that the process really wasn't open.
I was truly excited when the SSG material hit the pavement and, as
evidenced, has produced a very solid foundation that is slowly creeping
toward the sweet spot of security and usability.
Trevor
On Thu, Apr 17, 2014 at 3:15 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 4/15/14, 12:03 PM, Andrew Gilmore wrote:
> This is good news. I'm a graduate from the CIS community. :)
>
> I'd be interested in a concordance of rules from the current STIG target
> and the CIS product. I vaguely recall that the last time I ran the CIS
> benchmark, I found some items that probably should set in a "secure"
system
> that didn't seem to be in the current SSG profiles. It's been 1.5 years
> now, and I'm not recalling what those were.
>
> And no, the mcstrans removal was not one of them.
>
> I note that Steve Grubb and I are listed as contributors still.
>
When skimming through the C2S profile, one can quickly identify which CIS
sections don't map up to an existing XCCDF rule:
https://git.fedorahosted.org/cgit/scap-security-guide.git/
tree/RHEL/6/input/profiles/C2S.xml
Some are duplicate (e.g. 9.2.18 overlaps with 9.2.14), while CIS rules are
antiquated (e.g. 9.2.13).
I ask the following sincerely and without malice, mostly because I've
personally never seen anyone use CIS: what purpose does CIS serve?
Within the government we have civilian (USGCB) and DoD (STIG) baselines.
Within regulated commercial industries we have things like PCI and HIPAA.
I've always related the CIS baselines to non-regulated commercial
industries, though at RHT Summit, a very high amount of government people
said they were following the baseline. Why use CIS when you have STIG?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan(a)onyxpoint.com
-- This account not approved for unencrypted proprietary information --