[PATCH 02/21] Mapped CCI-001159 to requirement unclear.
Shawn Wells
shawn at redhat.com
Tue Jul 3 23:01:31 UTC 2012
On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001159 requires issuing or obtaining public key certificates under an appropriate certificate policy from an approved service provided. This mapping is to request input and/or discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index e42b590..4035c61 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,1097" />
> +<ref disa="20,31,218,219,224,1097,1159" />
> </Group> <!-- end requirement_unclear -->
>
> <Group id="new_rule_needed">
SRG-OS-000179 CCI-001159 The operating system must issue or obtain
public key certificates under an appropriate certificate policy from an
approved service provider. For user certificates, each organization
attains certificates from an approved, shared service provider, as
required by OMB policy. For federal agencies operating a legacy public
key infrastructure cross-certified with the Federal Bridge Certification
Authority at medium assurance or higher, this Certification Authority
will suffice. This control focuses on certificates with a visibility
external to the information system and does not include certificates
related to internal system operations, for example, application-specific
time services.
new_rule_needed, and that rule could be general prose saying that server
PKIs must come from an authoritative source (aka DoD or IC PKI).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/faf71f0e/attachment-0001.html>
More information about the scap-security-guide
mailing list