OS SRG mappings -- items unclear/impractical
Jeffrey Blank
blank at eclipse.ncsc.mil
Mon Jul 23 18:19:20 UTC 2012
Below is a list of items initially tagged as impractical, out of scope,
or unclear in the OS SRG mapping, along with suggestions/questions on
how to meet the requirements.
This email thread is to allow for further discussion on how these
requirements could be met, or provide documentation as such.
CCI-000024: BIOS settings, such as enabling hardware virtualization
and setting the BIOS password, are examples of security-relevant
information.
CCI-000037: Can RHEL6 mimic Solaris RBAC functionality via SELinux?
CCI-000066: Wouldn't an appropriate IPtables configuration satisfy
this requirement?
CCI-000213: The system must require authentication upon booting into
single-user and maintenance modes.
CCI-000213: System BIOS or system controllers supporting password
protection must have administrator accounts/passwords configured, and
no others.
CCI-000213: The system boot loader must require authentication
against hashes computed with FIPS 140-2 approved algorithms.
CCI-000224: All files and directories must have a valid owner and
group. (Borrowed from CCI-000366)
CCI-000535, et seq.: Does RHEL6 include any backup software, or is
this NA-DEP?
CCI-000553: All file systems must employ transaction-based file
systems.
CCI-001111: The operating system must not terminate virtual private
network (VPN) client sessions, unless it is documented as a VPN
concentrator.
CCI-001112: Can RHEL6 force proxy settings on mail and web traffic?
CCI-001126: Can RHEL6 iptables be set to default to "deny all" when
the iptables service is stopped? It looks like changing "set_policy
ACCEPT" to "set_policy DROP" in /etc/init.d/iptables might do the
trick, but that's profoundly evil.
CCI-001169, et seq.: NA, dependent upon application (browser, etc.)
requiring DoD-signed content.
CCI-001239: NA-DEP
CCI-001291: NA-DEP
CCI-001352: Get these audit records to a remote log server ASAP?
CCI-001372, et seq.: NA-DEP
CCI-001401: Regarding the "binding of organization-defined security
attributes to information in transmission", might a combination of
non-squashed UID mapping with tight controls on which remote systems
are allowed non-squashed NFS access cover this requirement?
CCI-001414: Use IPtables?
CCI-001555, et seq.: NA-DEP
CCI-001668: The system must use and update a DoD-approved virus scan
program.
CCI-001682: NA-DEP
CCI-001695: NA-DEP
More information about the scap-security-guide
mailing list