On Wednesday, January 07, 2015 11:03:44 AM Shawn Wells wrote:
>>> > > * Update OVAL checks to perform just
configuration testing by
>>> > > default,
>> >
>> > This is what they should be doing. Many of the issues I mentioned in
>> > the original email was because the prose did not match the OVAL checks.
>> > OVAL has limited capabilities. It cannot run auditctl or mount or any
>> > other external command. So, the prose need to reflect this limitation
>> > and be accurate so that people without a scanner can test by hand and
>> > get accurate results. That is the main issue I was reporting.
>
> Thank you for the clarification, Steve. It's clear now.
To meet the US Gov's requirements, profiles like the STIG should
check for *both* on-disk and runtime settings, though through different
XCCDF/OVAL rules.
From the 800-70:
2.1
Security Configuration Checklists
"A security configuration checklist (also referred to as a lockdown guide,
hardening guide, security guide,security technical implementation guide
[STIG], or benchmark) 3 is essentially a document that contains instructions
or procedures for configuring an IT product to an operational environment."
This is clearly about on disk configuration. Section 2.2 goes into more
details. There is a need for Forensic checks and it has been talked about
occassionally at SCAP Developer Days. But the OVAL support needed has never
gotten past having some discussions. So, OVAL simply doesn't have the means to
do much forensics.
Historically, the guides have also never discussed how to do one kind of check
vs the other. So, this would be entirely new.
-Steve