[PATCH 10/21] Mapped CCI-001166 to requirement_unclear.

Shawn Wells shawn at redhat.com
Tue Jul 3 23:43:54 UTC 2012


On 7/3/12 6:52 PM, Willy Santos wrote:
> CCI-001166 requires implementing detection and inspection mechanisms to identify unauthorized mobile code. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 4b00156..06b1b9d 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158" />
> +<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158,1166" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000180 	CCI-001166 	The operating system must implement detection 
and inspection mechanisms to identify unauthorized mobile code. 
Decisions regarding the employment of mobile code within organizational 
information systems are based on the potential for the code to cause 
damage to the system if used maliciously. Mobile code technologies 
include Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, 
Flash animations, and VBScript. Usage restrictions and implementation 
guidance apply to both the selection and use of mobile code installed on 
organizational servers and mobile code downloaded and executed on 
individual workstations.


I've met this in the past by setting up aide to tell me of all new files 
(detection), and then human reviewing them (inspection). Absolute PITA, 
but gets us through the requirement.

I'd map back to our usage of aide, ensuring that aide EMails SysAdmins 
with whatever changes and we include prose for periodic human review.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120703/7c8e2f65/attachment-0001.html>


More information about the scap-security-guide mailing list