On 12/28/18 11:06 AM, Chuck Atkins wrote:
I just noticed that all the EL derivatives in the current SSG no
longer get any of the government security profiles, only pci-dss and
standard. What happend to all of te other profiles available for RHEL7?
The ones for RHEL are still there, as are Ubuntu and OEL :)
Derivatives (e.g. CentOS) don't have STIGs or other formal US Gov config
baselines. Shipping baselines with formal names (e.g. STIG or NIST
National Checklist) for the derivatives was slightly misleading, and
some users thought derivatives held formal approvals (e.g. a CentOS STIG
published by DISA).
Other baselines, such as PCI-DSS, are generic and don't represent a
formal/"regulatory managed" baseline akin to DoD STIGs.
That said, baselines for derivatives are still needed by some in the
community. Could be an opportunity for someone to create a "FISMA" or
"NIST 800-53" style baseline since those are open standards.