[PATCH 09/26] Mapped CCI-000028 to requirement_unclear.

Shawn Wells shawn at redhat.com
Fri Jun 29 22:47:11 UTC 2012


On 6/29/12 5:45 PM, Willy Santos wrote:
> CCI-000028 requires the OS to prevent encrypted data from bypassing content checking mechanisms. This mapping is open to discussion and change.

SRG-OS-000012 	CCI-000028 	The operating system must prevent encrypted 
data from bypassing content checking mechanisms. 	Information flow 
control regulates where information is allowed to travel within an 
information system and between information systems (as opposed to who is 
allowed to access the information) and without explicit regard to 
subsequent accesses to the information. _When data is encrypted, 
mechanisms designed to examine data content to detect attacks or 
malicious code are unable to accomplish this task unless they are 
capable of unencrypting the data._


So... this requirement wants to the OS to mysteriously decrypt the data, 
pass it through an inspection tool, then re-encrypt it. My vote is 
/both/ unmet_impractical_guidance and unmet_impractical_product on this 
one.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120629/52231618/attachment.html>


More information about the scap-security-guide mailing list