[PATCH 05/21] Mapped CCI-001140 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:21:38 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001140 requires the OS to produce, control, and distribute symmetric cryptographic keys using NIST or NSA-approved key management technology and processes. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index e7d324b..2c8888a 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000165 	CCI-001140 	The operating system must produce, control, 
and distribute symmetric cryptographic keys using NIST-approved or 
NSA-approved key management technology and processes. 	Cryptographic key 
management and establishment can be performed using manual procedures or 
automated mechanisms with supporting manual procedures. In addition to 
being required for the effective operation of a cryptographic mechanism, 
effective cryptographic key management provides protections to maintain 
the availability of the information in the event of the loss of 
cryptographic keys by users.


This maps back to actual NIST controls here: 
http://web.nvd.nist.gov/view/800-53/control?controlName=SC-12 (skip to 
the "800-53A Information for Control SC-12" section). The accepted 
evaluation of this control is to examine /procedures/.

I would map this to new_rule_needed, and that rule should say to follow 
NIST 800-56A and NIST 800-57 for approved key management processes. 
Yeah, it's a cop out to say "go follow this other policy," but I'm OK 
with that as it (a) points the users to official processes, and (b) 
gives us time to detail this out in future versions of the guide.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/6fc53988/attachment.html>


More information about the scap-security-guide mailing list