I'm not sure if this is the place to talk about the specific content
of the security standards or if the SSG is more "meta"...
I see there is a test Rule ID: package_aide_installed.
I am inclined to think that the spirit
of this test is to have a file integrity monitoring (FIM) system.
But why AIDE specifically? There are a few options for FIM, but
not too many that one couldn't write tests to ensure that at least
one of the handful of fully featured OSS FIM solutions is
installed and configured. (other options that come to mind are
OSSEC and Samhain) Additionally, AIDE development seems to be
stagnant and perhaps not the best choice at this time.
Where is this guidance coming from? Is the source of the guidance
really technology specific or is the choice of AIDE just a
specific interpretation of a more general guidance for a FIM
solution? What's the rationale, if so?
-Bond