[PATCH 03/21] Mapped CCI-001125 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:10:51 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001125 requires employing automated mechanisms to enforce strict adherence to protocol format. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 4035c61..caf0ac4 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159" />
> +<ref disa="20,31,218,219,224,1097,1159,1125" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000155 	CCI-001125 	The operating system must employ automated 
mechanisms to enforce strict adherence to protocol format. 	Crafted 
packets not conforming to IEEE standards can be used by malicious people 
to exploit a host’s protocol stack to create a Denial of Service or 
force a device reset.


This also indirectly maps back to NIST 800-53 SC-7(10):

SC-7(10)

Description

    The organization prevents the unauthorized exfiltration of
    information across managed interfaces.

Enhancement Supplemental Guidance

    Measures to prevent unauthorized exfiltration of information from
    the information system include, for example: (i) strict adherence to
    protocol formats;

...
<rest snipped by swells>\...



I'm so far from a networking guru that it's not funny, but over at 
Westfields we're doing the following to meet this. Perhaps 
new_rule_needed with the following text:

> # force SYN packet check for SC-7(10)
> # makes sure NEW connections start with a SYN packet,
> # if they don't could be an indication of misformed connection & protocols
> -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
>
> # check for malformed XMAS packets for SC-7(10)
> -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
>
> # drop all NULL packets for SC-7(10)
> -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
>
> # force fragment packet check for SC-7(10)
> # packets with incoming fragments get dropped
> -A INPUT -f -j DROP

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/30867ecb/attachment.html>


More information about the scap-security-guide mailing list