[PATCH 09/21] Mapped CCI-001158 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:40:59 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001158 requires validating the integrity of security attributes exchanged between systems. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 6261c13..4b00156 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000178 	CCI-001158 	The operating system must validate the 
integrity of security attributes exchanged between systems. 	When data 
is exchanged between information systems, the security attributes 
associated with the data needs to be maintained. Security attributes are 
an abstraction representing the basic properties or characteristics of 
an entity with respect to safeguarding information; typically associated 
with internal data structures (e.g., records, buffers, files) within the 
information system and used to enable the implementation of access 
control and flow control policies, reflect special dissemination, 
handling or distribution instructions, or support other aspects of the 
information security policy. Security attributes may be explicitly or 
implicitly associated with the information contained within the 
information system.


I'm leaning towards impractical_guidance by associating this with 
implementing CCI-001157.

But I'm also leaning towards saying the integrity is validated through 
the fact all connections are encrypted via OpenSSL and mapping this to 
use_ssl (or whatever we called it).

Both seem valid to me... need someone to be the tie breaker (Cliff, 
Jeff, Joe?).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/ffa54fe2/attachment.html>


More information about the scap-security-guide mailing list