Thanks Jeff. I concur wholeheartedly with not using the x.y.z references. I haven't
seen a overlay for DISA STIG <-> SSG Rule maping, is this internal to DISA or buried
somewhere in the SSG?
-Rob
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Jeffrey Blank
[blank(a)eclipse.ncsc.mil]
Sent: Monday, August 19, 2013 5:50 PM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: SSG line item references
The Rule id (the id attribute) in SSG is your best bet for a stable
identifier. This is what Profiles use to reference Rules, too. The
x.y.z-style section numbers may change at any time and they should not
be used as references.
I will shortly be posting a table that shows the ID in human readable form.
The STIG "overlay" should provide linkage between the issued DISA IDs
(randomly assigned numbers), but I do not know if this is accurate at
present. Maintaining transparent, reproducible linkage between the SSG
upstream and the issued STIG remains a goal.
It may be worth revisiting, with DISA, the idea of the STIG as a Profile
in SSG instead of this overlay construct.
On 08/19/2013 10:59 AM, Robert Sanders wrote:
Quick question - I'm looking at the SSG content files and trying
to
determine the 'line item' number for a particular check. The DISA STIG
content is layed out so that the line item information (i.e.,
rhel-06-0000001) is inline with a particular check. The SSG content
doesn't appear to have this inline, and I suspect that the line items
are being generated programmatically via the oscap command but I haven't
drilled down to see what oscap is actually doing. Considering that the
SSG is the upstream document for the RHEL6 STIG - is DISA responsible
for remapping the SSG items to the STIG items, or will DISA adopt the
way that the SSG is generating line items? If the latter, could this
result in line item x.z.y from version A be a *very* different best than
line item x.y.z from version B?
-Rob
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide