[PATCH 19/25] Mapped CCI-001092 to requirement_unclear.

Shawn Wells shawn at redhat.com
Wed Jun 27 22:29:49 UTC 2012


On 6/27/12 6:18 PM, Willy Santos wrote:
> Signed-off-by: Willy Santos <wsantos at redhat.com>
> ---
>   rhel6/src/input/auxiliary/srg_support.xml |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
> index c070e02..6167107 100644
> --- a/rhel6/src/input/auxiliary/srg_support.xml
> +++ b/rhel6/src/input/auxiliary/srg_support.xml
> @@ -29,7 +29,7 @@ The requirement is impractical or out of scope.
>   <description>
>   It is unclear how to satisfy this requirement.
>   </description>
> -<ref disa="20,31,218,219,224,386" />
> +<ref disa="20,31,218,219,224,386,1092" />
>   </Group> <!-- end unmet_impractical_product -->
>   
>   <Group id="new_rule_needed">



SRG-OS-000140 	CCI-001092 	The operating system must protect against or 
must limit the effects of the organization-defined or referenced types 
of Denial of Service attacks. 	A variety of technologies exist to limit, 
or in some cases, eliminate the effects of Denial of Service attacks. 
Employing increased capacity combined with service redundancy may reduce 
the susceptibility to some Denial of Service attacks.


Could we argue that this is met by:
- Enabling IPTables
- Setting account password retries in PAM
- Turning off standard icmp responses

We certainly can't provide comprehensive protection against this at the 
OS layer, but the above "limits the effects" enough for a mapping.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120627/9b7bd0ab/attachment.html>


More information about the scap-security-guide mailing list