Vincent,

I hear you.

The criminals/miscreants are getting better.  System security, in order to be relevant, is a step or two above what they are capable of.  Windoze has been a huge target for a long time, yet the miscreants are learning that significant data is being held and processed in and thru linux systems, especially Red Hat ones.  Fact.  Either we get proactive and step our game before we get hurt, or we get our asses handed to us because we let them hurt us.

My contention is that a finding is defined that way... because is SHOULD be a finding.  The details or specificity shouldn't be because one particular customer has it hard.  The details should be established as right, because it's how we keep ahead of the thieves of our data, much less time and administrative authority over our own systems/enclaves.

You might be right about what the JITC needs to do, or where certain things need to come from, or go to, for all of DoD.  But, this forum can't fix that.  We don't have the authority, and aren't plugged into the right organizations in order to affect such changes.

What we can do is affect the direction of the next generation of consensus-built Linux OS security guidance, hardening methodologies, and scoring/assessment tool/content.

R,
-Joe


From: Vincent Passaro <vince.passaro@fotisnetworks.com>
To: "scap-security-guide@lists.fedorahosted.org" <scap-security-guide@lists.fedorahosted.org>
Sent: Monday, October 29, 2012 1:11 PM
Subject: RE: SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP

 
 
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: Monday, October 29, 2012 9:28 AM
To: scap-security-guide@lists.fedorahosted.org
Subject: Re: SEVERE impact - SE Linux being imposed by Red Hat 6 SCAP
 
On 10/29/12 10:17 AM, Joe Wulf wrote:
Improvements in security are collective as time and technology mature.  The reality of being a CAT I or a CAT II finding can certainly be further debated, but you articulate to us what seems like the basis for your waiver for your Accreditation---not the exception that should be imposed on everyone else who doesn't live under the same circumstances/situation you are.
 
This is compliance for the entire DoD, not just what the IC community thinks is best for their environment.

I don't think I could have articulated that better than Joe just did. Do note that based off the DoD Consensus call last week we did lower this from a High/Cat I finding to a Medium/Cat II. I ack'd the patch myself, ref:

https://lists.fedorahosted.org/pipermail/scap-security-guide/2012-October/002072.html

With that said, I see absolutely no circumstances under which disabling the major host security protection mechanism should ever be disabled. Especially for systems delivering warfighter capabilities. As for McAfee, even they got their act together and issued guidance on how to properly make HBSS work with SELinux:
 
That’s just ONE piece of software.  What about the rest?  You need to force the Software vendors to adopt Red Hat’s way of security, not the warfighter.

https://kc.mcafee.com/corporate/index?page=content&id=KB67360&cat=CORP_VIRUSSCAN_ENTERPRISE_FOR_LINUX_1.8&actp=LIST
 
 
Forcing the warfighter to try and jackhammer software onto an OS where they can’t see / modify the code is ridiculous and will take more time away from the mission / security and put more time into goofing with compliance.  If SELinux is to be implemented it needs to be done at a lower level (JITC comes to mind) where software vendors (not the warfighter) have to meet the requirements to operate within the DoD.


Given that today the RHEL6 Common Criteria Certification was announced [1], which requires SELinux to be enabled to be compliant, you may see this be bumped back up to a Cat I/high finding.
 
Given that the DISA people on the call didn’t seem to really push for having it a CAT I finding, hopefully this won’t happen and hopefully ‘we’ don’t do this because ‘we’ believe it’s a good thing to do.

_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide