On 10/29/12 10:17 AM, Joe Wulf wrote:
Improvements in security are collective as time and technology
mature. The reality of being a CAT I or a CAT II finding can
certainly be further debated, but you articulate to us what seems like
the basis for your waiver for your Accreditation---not the exception
that should be imposed on everyone else who doesn't live under the
same circumstances/situation you are.
I don't think I could have articulated that better than Joe just did. Do
note that based off the DoD Consensus call last week we did lower this
from a High/Cat I finding to a Medium/Cat II. I ack'd the patch myself, ref:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October...
With that said, I see absolutely no circumstances under which disabling
the major host security protection mechanism should _ever_ be disabled.
Especially for systems delivering warfighter capabilities. As for
McAfee, even they got their act together and issued guidance on how to
properly make HBSS work with SELinux:
https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat...
Given that *today* the RHEL6 Common Criteria Certification was announced
[1], which requires SELinux to be enabled to be compliant, you may see
this be bumped back up to a Cat I/high finding.
-Shawn
[1]
http://www.net-security.org/secworld.php?id=13856