On 3/1/16 8:48 AM, Mike Kuhnkey wrote:
Yes. Greatly!  Red Hat responds to industry generated CCE's while DISA will eventually generate CCI's mapped to their current STIG release?

NIST gives vendors an assignment of CCEs to pair with configuration guidance. OpenSCAP/SSG serves as Red Hat's configuration community, so within SSG we assign CCEs to specific XCCDF rules.

In the past DISA has used CCIs, however those should be abstracted away from end-users. With RHEL7 STIG content, you'll likely need to attest to either the RHEL-07-##### control (from DISA), or more SCA's will want users will attest against the CCE (which maps back to NIST 800-53).

Both SRG & CCI references appear to be falling from grace as far as providing stability for shared rule references (multi-platform from a Red Hat perspective),and ...we can only guess for DISA.  I have an unrelated question to XCCDF_POLICY engine which I'll put in another thread.  Thank you for clarification!

In recent times the SRGs are meant to reflect DISA's control selections and refinements from NIST 800-53. DISA CCI's then come along and provide the "ability to trace security requirements from their origin to their low-level implementation" [0]... aka specific implementation guidance for a product. Sprinkled in are the RHEL-07-##### identifiers. And then we have CCEs that are assigned by NIST/vendors. What controls do you need to actually document compliance against during system accreditation? It's confusing as hell.

Within SSG, we map each XCCDF rule to a CCE. That CCE is then mapped to regulatory identifiers.

To make all this real, we can look at the RHEL6 "audit_rules_time_watch_localtime" rule:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/xccdf/system/auditing.xml#L637-L660

It contains this snippet of code:
<ident cce="27172-6" stig="RHEL-06-000173" /> <oval id="audit_rules_time_watch_localtime" />
<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5" />
<ref disa="1487,169" />

so from that, we can see:
- XCCDF rule "audit_rules_time_watch_localtime" is mapped to Red Hat CCE-27172-6
- CCE-27172-6 is further mapped against
        * NIST 800-53 AC-3(10), AU-1(b), AU-2(a), AU-2(c), AU-2(d), AU-12(a), AU-12(c), IR-5
        * DISA CCI's 1487 and 169

When OpenSCAP verifies compliance with CCE-27172-6, we're able to generate reports that show conformance with the above DISA CCIs and document configuration against the NIST controls.

That mapping is how we generate the sample RTMs, such as the RHEL6 NIST table:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-nistrefs-common.html

[0] http://iase.disa.mil/stigs/cci/Pages/index.aspx

-- 
Shawn Wells
Chief Security Strategist
U.S. Public Sector
shawn@redhat.com | 443.534.0130