[PATCH 19/25] Mapped CCI-001092 to requirement_unclear.
Shawn Wells
shawn at redhat.com
Wed Jun 27 22:29:49 UTC 2012
On 6/27/12 6:18 PM, Willy Santos wrote:
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
> rhel6/src/input/auxiliary/srg_support.xml | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index c070e02..6167107 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
> <description>
> It is unclear how to satisfy this requirement.
> </description>
> -<ref disa="20,31,218,219,224,386" />
> +<ref disa="20,31,218,219,224,386,1092" />
> </Group> <!-- end unmet_impractical_product -->
>
> <Group id="new_rule_needed">
SRG-OS-000140 CCI-001092 The operating system must protect against or
must limit the effects of the organization-defined or referenced types
of Denial of Service attacks. A variety of technologies exist to limit,
or in some cases, eliminate the effects of Denial of Service attacks.
Employing increased capacity combined with service redundancy may reduce
the susceptibility to some Denial of Service attacks.
Could we argue that this is met by:
- Enabling IPTables
- Setting account password retries in PAM
- Turning off standard icmp responses
We certainly can't provide comprehensive protection against this at the
OS layer, but the above "limits the effects" enough for a mapping.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120627/9b7bd0ab/attachment.html>
More information about the scap-security-guide
mailing list