[PATCH 09/37] Mapped CCI-001395 to requirement_unclear.

Shawn Wells shawn at redhat.com
Sat Jul 7 01:07:09 UTC 2012


On 7/6/12 2:58 PM, Willy Santos wrote:
> CCI-001395 requires notifying the user of org-defined security-related changes to the user's account. This mapping is a request for input/discussion.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index 7000b12..48fca75 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,1097,1158,1291,1294,1295" />
> +<ref disa="20,31,218,219,224,1097,1158,1291,1294,1295,1395" />
>   </Group> <!-- end requirement_unclear -->
>   
>   <Group id="new_rule_needed">

SRG-OS-000235 	CCI-001395 	The operating system must notify the user of 
organization-defined security-related changes to the user’s account that 
occur during the organization-defined time period. 	Some organizations 
may define certain security events as events requiring user 
notification. An organization may define an event such as a password 
change to a user's account occurring outside of normal business hours as 
a security related event that requires the user be notified. In those 
instances where organizations define such events, the operating system 
must notify the affected user or users.


for now, unmet_impractical_product. There are IDS/audit log watchers 
(snort, etc) for this.

*technically* we can update the users shell profile to run an aureport 
on any activity between their last login and the present time, however 
that would be a bit of a hack.

If this is going to be important we should open up an RFE to get this 
functionality included in RHEL. It didn't come up during the RHEL7 
planning meetings, so to set expectations, there's pretty much no way 
this would happen until a few service packs into RHEL7.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120706/e5bde586/attachment-0001.html>


More information about the scap-security-guide mailing list