OS SRG mappings -- items unclear/impractical

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 23 18:19:20 UTC 2012


Below is a list of items initially tagged as impractical, out of scope,
or unclear in the OS SRG mapping, along with suggestions/questions on
how to meet the requirements.

This email thread is to allow for further discussion on how these
requirements could be met, or provide documentation as such.



CCI-000024:  BIOS settings, such as enabling hardware virtualization
and setting the BIOS password, are examples of security-relevant
information.

CCI-000037:  Can RHEL6 mimic Solaris RBAC functionality via SELinux?


CCI-000066:  Wouldn't an appropriate IPtables configuration satisfy
this requirement?

CCI-000213:  The system must require authentication upon booting into
single-user and maintenance modes.

CCI-000213:  System BIOS or system controllers supporting password
protection must have administrator accounts/passwords configured, and
no others.

CCI-000213:  The system boot loader must require authentication
against hashes computed with FIPS 140-2 approved algorithms.

CCI-000224:  All files and directories must have a valid owner and
group.  (Borrowed from CCI-000366)

CCI-000535, et seq.:  Does RHEL6 include any backup software, or is
this NA-DEP?

CCI-000553:  All file systems must employ transaction-based file
systems.

CCI-001111:  The operating system must not terminate virtual private
network (VPN) client sessions, unless it is documented as a VPN
concentrator.

CCI-001112:  Can RHEL6 force proxy settings on mail and web traffic?

CCI-001126:  Can RHEL6 iptables be set to default to "deny all" when
the iptables service is stopped?  It looks like changing "set_policy
ACCEPT" to "set_policy DROP" in /etc/init.d/iptables might do the
trick, but that's profoundly evil.

CCI-001169, et seq.:  NA, dependent upon application (browser, etc.)
requiring DoD-signed content.

CCI-001239:  NA-DEP

CCI-001291:  NA-DEP

CCI-001352:  Get these audit records to a remote log server ASAP?

CCI-001372, et seq.:  NA-DEP

CCI-001401:  Regarding the "binding of organization-defined security
attributes to information in transmission", might a combination of
non-squashed UID mapping with tight controls on which remote systems
are allowed non-squashed NFS access cover this requirement?

CCI-001414:  Use IPtables?

CCI-001555, et seq.:  NA-DEP

CCI-001668:  The system must use and update a DoD-approved virus scan
program.

CCI-001682:  NA-DEP

CCI-001695:  NA-DEP


More information about the scap-security-guide mailing list