[PATCH] changed major transforms to handle CCIs as references instead of idents
Jeffrey Blank
blank at eclipse.ncsc.mil
Wed May 2 22:09:05 UTC 2012
> (1) Who is the "authoritative source" on mapping CCIs back to 800-53? /
The CCI list defines all the CCIs, and maps them back to 800-53. The
CCI is an invention of DISA FSO, and maintained by them.
More explanation here:
http://iase.disa.mil/cci/index.html
I also put the list in scap-security-guide in the references folder.
> For right or wrong it's been my experience that C&A teams care about
> 800-53 mappings and really haven't heard of CCIs. Because of this I
> believe it'd be incredibly beneficial for us to provide some mapping
> back to NIST 800-53. I know DISA did a CCI to OS SRG mapping, and kindly
> put some NIST 800-53 refs in there, but I have the understanding that is
> not "authoritative." I'd be more than happy to be wrong though!
It all depends on what the C&A person wants to see (which likely depends
on where they are in USG). A DoD C&A person probably wants to see
guidance from a STIG applied. A STIG-compliant system (because the STIG
satisfies the requirements listed in the SRG, which is really a
selection of CCIs) can be mapped back to 800-53 controls.
Of course, we have some items that we've individually mapped back to
800-53 controls (which may be very platform specific or which may simply
indicate a best practice which happens to comport with an 800-53
control). Not all of these may not fit into a CCI, which is why "nist="
also exists as a direct reference.
> Is there an authoritative source of CCI to NIST mappings,
That's what the CCI list is.
> and if so,
> perhaps we could create some transformational pixie dust that takes our
> CCI mapping and correlates it back to 800-53? This would also free us
> from having to manually perform a <ref nist=*> for the rules.
Yes -- that's exactly why I have the CCI list in references. It's so
that we can write a transform to do exactly this.
If you want to write a ticket and assign it to me...
> [1]
> http://people.redhat.com/swells/scap-security-guide-0.1/policytables/rhel6-table-srgmap.html
>
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list