[PATCH 21/37] Mapped CCI-001555 to unmet_impractical_guidance.

Shawn Wells shawn at redhat.com
Sat Jul 7 01:23:54 UTC 2012


On 7/6/12 2:59 PM, Willy Santos wrote:
> CCI-001555 requires uniquely identifying destination domains for information transfer. Cross domain solutions are out of the scope of this guide.
>
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index a087c24..ad3592c 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -21,7 +21,7 @@ Red Hat Enterprise Linux meets this requirement by design.
>   The guidance does not meet this requirement.
>   The requirement is impractical or out of scope.
>   </description>
> -<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1687,1121,417,71,69,1444,1443,1688,152,145,1247,1245,1243,1242,1241,1240,1308,1306,1305,1196,1677,1188,1187,1673,1186,1672,1185,1671,1184,1183,1664,1663,1182,1181,1180,1179,1574,1178,1167,1463,1273,1272,1266,1262,1259,1249,1119,870,833,1340,1352,1401,1414" />
> +<ref disa="165,21,354,1094,371,372,535,537,539,780,1682,1383,370,66,37,213,221,25,28,29,30,24,1112,1111,1126,1149,1157,1210,1211,1341,1372,1373,1374,1376,1377,1687,1121,417,71,69,1444,1443,1688,152,145,1247,1245,1243,1242,1241,1240,1308,1306,1305,1196,1677,1188,1187,1673,1186,1672,1185,1671,1184,1183,1664,1663,1182,1181,1180,1179,1574,1178,1167,1463,1273,1272,1266,1262,1259,1249,1119,870,833,1340,1352,1401,1414,1555" />
>   </Group> <!-- end unmet_impractical_guidance -->
>   
>   <Group id="unmet_impractical_product">

SRG-OS-000261 	CCI-001555 	The operating system uniquely must identify 
destination domains for information transfer. 	Information flow control 
regulates where information is allowed to travel within an information 
system and between information systems (as opposed to who is allowed to 
access the information) and without explicit regard to subsequent 
accesses to the information. Attribution, e.g., the ability to attribute 
actions to certain individuals, is a critical component of a security 
concept of operations. The ability to identify source and destination 
points for information flowing in an information system, allows forensic 
reconstruction of events when required, and increases policy compliance 
by attributing policy violations to specific organizations/individuals.


Would host keys through the use of OpenSSL count as a unique identifier 
for the destination?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120706/fc41752c/attachment-0001.html>


More information about the scap-security-guide mailing list