[PATCH 04/21] Mapped CCI-001126 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:15:07 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001126 requires the OS to fail securely inthe event of an operational failure of a boundary protection service. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index caf0ac4..e7d324b 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">



SRG-OS-000156 	CCI-001126 	The operating system must fail securely in 
the event of an operational failure of a boundary protection device. 
Fail secure is a condition achieved by the operating system employing a 
set of information system mechanisms to ensure, in the event of an 
operational failure of a boundary protection device at a managed 
interface, the system does not enter into an unsecure state where 
security properties no longer hold.


Generally "boundary protection device at a managed interface" == 
firewalls, switches, etc

I'm unaware of a trusted/reliable method for an OS to detect such a 
failure. Maintain a ping to the firewall and if it drops, fail securely? 
Attempt to login to the boundry device, and if failure, crash the OS?

Arguably a valid requirement, but I'm not convinced it belongs at the OS 
level. impractical_guidance IMHO.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/4a732d16/attachment.html>


More information about the scap-security-guide mailing list