[PATCH 05/21] Mapped CCI-001140 to requirement_unclear.
Shawn Wells
shawn at redhat.com
Tue Jul 3 23:21:38 UTC 2012
On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001140 requires the OS to produce, control, and distribute symmetric cryptographic keys using NIST or NSA-approved key management technology and processes. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index e7d324b..2c8888a 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140" />
> </Group> <!-- end requirement_unclear -->
>
> <Group id="new_rule_needed">
SRG-OS-000165 CCI-001140 The operating system must produce, control,
and distribute symmetric cryptographic keys using NIST-approved or
NSA-approved key management technology and processes. Cryptographic key
management and establishment can be performed using manual procedures or
automated mechanisms with supporting manual procedures. In addition to
being required for the effective operation of a cryptographic mechanism,
effective cryptographic key management provides protections to maintain
the availability of the information in the event of the loss of
cryptographic keys by users.
This maps back to actual NIST controls here:
http://web.nvd.nist.gov/view/800-53/control?controlName=SC-12 (skip to
the "800-53A Information for Control SC-12" section). The accepted
evaluation of this control is to examine /procedures/.
I would map this to new_rule_needed, and that rule should say to follow
NIST 800-56A and NIST 800-57 for approved key management processes.
Yeah, it's a cop out to say "go follow this other policy," but I'm OK
with that as it (a) points the users to official processes, and (b)
gives us time to detail this out in future versions of the guide.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/6fc53988/attachment.html>
More information about the scap-security-guide
mailing list