On 10/29/12 10:17 AM, Joe Wulf wrote:
Improvements in security are collective as time and
technology mature. The reality of being a CAT I or a CAT II
finding can certainly be further debated, but you articulate to us
what seems like the basis for your waiver for your
Accreditation---not the exception that should be imposed on
everyone else who doesn't live under the same
circumstances/situation you are.
I don't think I could have articulated that better than Joe just
did. Do note that based off the DoD Consensus call last week we did
lower this from a High/Cat I finding to a Medium/Cat II. I ack'd the
patch myself, ref:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html
With that said, I see absolutely no circumstances under which
disabling the major host security protection mechanism should ever
be disabled. Especially for systems delivering warfighter
capabilities. As for McAfee, even they got their act together and
issued guidance on how to properly make HBSS work with SELinux:
https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST
Given that today the RHEL6 Common Criteria Certification was
announced [1], which requires SELinux to be enabled to be compliant,
you may see this be bumped back up to a Cat I/high finding.
-Shawn
[1] http://www.net-security.org/secworld.php?id=13856