[PATCH 09/21] Mapped CCI-001158 to requirement_unclear.
Shawn Wells
shawn at redhat.com
Tue Jul 3 23:40:59 UTC 2012
On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001158 requires validating the integrity of security attributes exchanged between systems. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 6261c13..4b00156 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158" />
> </Group> <!-- end requirement_unclear -->
>
> <Group id="new_rule_needed">
SRG-OS-000178 CCI-001158 The operating system must validate the
integrity of security attributes exchanged between systems. When data
is exchanged between information systems, the security attributes
associated with the data needs to be maintained. Security attributes are
an abstraction representing the basic properties or characteristics of
an entity with respect to safeguarding information; typically associated
with internal data structures (e.g., records, buffers, files) within the
information system and used to enable the implementation of access
control and flow control policies, reflect special dissemination,
handling or distribution instructions, or support other aspects of the
information security policy. Security attributes may be explicitly or
implicitly associated with the information contained within the
information system.
I'm leaning towards impractical_guidance by associating this with
implementing CCI-001157.
But I'm also leaning towards saying the integrity is validated through
the fact all connections are encrypted via OpenSSL and mapping this to
use_ssl (or whatever we called it).
Both seem valid to me... need someone to be the tie breaker (Cliff,
Jeff, Joe?).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/ffa54fe2/attachment.html>
More information about the scap-security-guide
mailing list