Seeking Input - CCI-001488 - What do do when audit fails?

Jeffrey Blank blank at eclipse.ncsc.mil
Thu Apr 26 17:08:32 UTC 2012


Please also keep in mind that when you write Rules, that you may be
effectively forcing people to do something on a wider scale.  Sometimes
this is a good thing, but other times it can be
onerous/counterproductive.  Since judgment/interpretation must
necessarily be exercised when making decisions about the intent of
requirements, this is also worth keeping in mind.

For some items, <Values> can be used (as variables) to provide some
flexibility for other parties (or for later adjustment).

Consensus meetings for particular baselines will also review items to
ensure their operational practicality.




On 04/25/2012 11:49 PM, Shawn Wells wrote:
> (apologies if this is a dupe, received a bounce on my original posting)
> 
> 
> CCI-001488 requires that we do something when the auditd system fails.
> Right now we have no rules for that.
> 
> For Red Hat's LSPP profiles we set failure mode to panic. Thoughts?
> Objections?
> 
> -Shawn
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list