This is good news. I'm a graduate from the CIS community. :)

I'd be interested in a concordance of rules from the current STIG target and the CIS product. I vaguely recall that the last time I ran the CIS benchmark, I found some items that probably should set in a "secure" system that didn't seem to be in the current SSG profiles. It's been 1.5 years now, and I'm not recalling what those were.

And no, the mcstrans removal was not one of them.

I note that Steve Grubb and I are listed as contributors still.

Andrew Gilmore


On Tue, Apr 15, 2014 at 12:49 PM, Jeffrey Blank <blank@eclipse.ncsc.mil> wrote:
There are a few instances where there are XCCDF Rule and OVAL
definition mismatches (typos), which a quick oscap eval will catch,
but if you could tidy those up it's good to go.

It's great to see that CIS customers can use this content now to get
automated checking for that Benchmark, which despite being copyrighted
and available only behind a paywall was composed almost entirely of
public-domain US Government Works.

We will want to reach out to CIS about moving toward an open source
process in collaboration with Red Hat.  This will allow them to create
a Profile (and the automation content provided by scap-security-guide)
to track with RHEL and be continuously improved and supported.







On Tue, Apr 15, 2014 at 11:30 AM, Shawn Wells <shawn@redhat.com> wrote:
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide@lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide