[PATCH 02/21] Mapped CCI-001159 to requirement unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:01:31 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001159 requires issuing or obtaining public key certificates under an appropriate certificate policy from an approved service provided. This mapping is to request input and/or discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index e42b590..4035c61 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097" />
> +<ref disa="20,31,218,219,224,1097,1159" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">



SRG-OS-000179 	CCI-001159 	The operating system must issue or obtain 
public key certificates under an appropriate certificate policy from an 
approved service provider. 	For user certificates, each organization 
attains certificates from an approved, shared service provider, as 
required by OMB policy. For federal agencies operating a legacy public 
key infrastructure cross-certified with the Federal Bridge Certification 
Authority at medium assurance or higher, this Certification Authority 
will suffice. This control focuses on certificates with a visibility 
external to the information system and does not include certificates 
related to internal system operations, for example, application-specific 
time services.


new_rule_needed, and that rule could be general prose saying that server 
PKIs must come from an authoritative source (aka DoD or IC PKI).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/faf71f0e/attachment-0001.html>


More information about the scap-security-guide mailing list