[PATCH 10/26] Mapped CCI-000029 to requirement_unclear.
Shawn Wells
shawn at redhat.com
Fri Jun 29 22:49:23 UTC 2012
On 6/29/12 5:45 PM, Willy Santos wrote:
> CCI-000029 requires enforcing org-defined limitations on embedding of data within other data types. This mapping is open to discussion and change.
SRG-OS-000013 CCI-000029 The operating system must enforce
organization-defined limitations on the embedding of data types within
other data types. Embedding of data within other data is often used for
the clandestine transfer of data. Embedding of data within other data
can circumvent protections in place to protect information and systems.
unmet_impractical_guidance - Creating prose to do this is beyond the
scope of a general security guide. And there's no requirement in NIST
800-53 that actually says to do this.
and unmet_impractical_product - I don't see this being technically
feasible at an operating system level. That is what 3rd party ISVs are for.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120629/141090de/attachment-0001.html>
More information about the scap-security-guide
mailing list