[PATCH 21/37] Mapped CCI-001555 to unmet_impractical_guidance.
Shawn Wells
shawn at redhat.com
Sat Jul 7 01:23:54 UTC 2012
On 7/6/12 2:59 PM, Willy Santos wrote:
> CCI-001555 requires uniquely identifying destination domains for information transfer. Cross domain solutions are out of the scope of this guide.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index a087c24..ad3592c 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design.
> The guidance does not meet this requirement.
> The requirement is impractical or out of scope.
> </description>
> -<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1687,1121,417,71,69,1444,1443,1688,152,145,1247,1245,1243,1242,1241,1240,1308,1306,1305,1196,1677,1188,1187,1673,1186,1672,1185,1671,1184,1183,1664,1663,1182,1181,1180,1179,1574,1178,1167,1463,1273,1272,1266,1262,1259,1249,1119,870,833,1340,1352,1401,1414" />
> +<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1687,1121,417,71,69,1444,1443,1688,152,145,1247,1245,1243,1242,1241,1240,1308,1306,1305,1196,1677,1188,1187,1673,1186,1672,1185,1671,1184,1183,1664,1663,1182,1181,1180,1179,1574,1178,1167,1463,1273,1272,1266,1262,1259,1249,1119,870,833,1340,1352,1401,1414,1555" />
> </Group> <!-- end unmet_impractical_guidance -->
>
> <Group id="unmet_impractical_product">
SRG-OS-000261 CCI-001555 The operating system uniquely must identify
destination domains for information transfer. Information flow control
regulates where information is allowed to travel within an information
system and between information systems (as opposed to who is allowed to
access the information) and without explicit regard to subsequent
accesses to the information. Attribution, e.g., the ability to attribute
actions to certain individuals, is a critical component of a security
concept of operations. The ability to identify source and destination
points for information flowing in an information system, allows forensic
reconstruction of events when required, and increases policy compliance
by attributing policy violations to specific organizations/individuals.
Would host keys through the use of OpenSSL count as a unique identifier
for the destination?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120706/fc41752c/attachment-0001.html>
More information about the scap-security-guide
mailing list