[PATCH 10/26] Mapped CCI-000029 to requirement_unclear.

Shawn Wells shawn at redhat.com
Fri Jun 29 22:49:23 UTC 2012


On 6/29/12 5:45 PM, Willy Santos wrote:
> CCI-000029 requires enforcing org-defined limitations on embedding of data within other data types. This mapping is open to discussion and change.

SRG-OS-000013 	CCI-000029 	The operating system must enforce 
organization-defined limitations on the embedding of data types within 
other data types. 	Embedding of data within other data is often used for 
the clandestine transfer of data. Embedding of data within other data 
can circumvent protections in place to protect information and systems.


unmet_impractical_guidance - Creating prose to do this is beyond the 
scope of a general security guide. And there's no requirement in NIST 
800-53 that actually says to do this.

and unmet_impractical_product - I don't see this being technically 
feasible at an operating system level. That is what 3rd party ISVs are for.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120629/141090de/attachment-0001.html>


More information about the scap-security-guide mailing list