The methodology I have seen is that current standards are applied to older or EOL
installations, so the RHEL 5 STIG would be used to manually to verify compliance. This is
definitely not a standard from DISA, as test plans are dictated by the individual CA / DAA
on a case by case basis.
Vince
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Robert Sanders
[rsanders(a)TrustedCS.com]
Sent: Wednesday, December 19, 2012 6:51 AM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Legacy RHEL systems and SRR/SCAP
Hello all,
Just in time for the holidays, I figured I'd ask an end-of-the-year naïve question.
What are people doing if older RHEL4 based systems are in production and need to be
locked-down? Use the SRR (even though retired), the RHEL5 guidelines (understanding that
'things work different'), hope and pray?
-Rob
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide