draft notes & actions from 25-OCT DoD call
Shawn Wells
shawn at redhat.com
Thu Oct 25 18:25:04 UTC 2012
Here are the notes that Michele and I took during the call. Before I
send to a wider list (gov-sec, mil-oss, etc) what'd I forget? Also using
this list to generate action items.
Procedural Next Steps:
(1) Flurry of activity today to finalize severity ratings, services, etc.
(2) Shawn to generate a "STIG Informal Draft RC1" RPM. Perhaps using a
more clever name.
(3) DISA FSO to publicly publish a "Informal Draft" by 7-NOV. This draft
will include prose only -- no automation.
(4) DISA FSO to publicly publish a "Formal Draft" by 26-DEC. Still no
automation.
(5) Public comment period on "Formal Draft" ends on 17-DEC
(6) Once comments are included/requirements formalized by DISA FSO, OVAL
content review begins 9-JAN
(7) DSAWG (sp?) review 12/13-FEB
(8) Delivery of OVAL to government in April
(9) Final RHEL6 STIG, including automation, ~20-MAY-2013
Required changes based on 25-OCT DoD Consensus Call:
(1) Need to remove notes about network services.
(2) Change banner severity to medium. Strong feedback from DoD community
this must be medium for legal requirements
(3) SELinux should never be disabled, but permissive could be OK. Need
to update wording. Need to include prose around how to disable specific
enforcement types to allow SELinux to remain enforcing while unenforcing
select apps.
(4) Re-enforce RHEL6 STIG should not mandate a host security tool.
Double check wording AND OVAL of existing content
(5) GEN 1780 still applies? Need decision
(6) System Security Daemon content
(7) Add OVAL check for recursive filesystem walks to only check local
filesystems, otherwise locks machine. Michele thinks xdev will do the trick.
(8) Remove the V-7 check or add language somehow indicating it's OK to
run RHNSD when connecting to Satellite
(9) Add content for RHSM, Red Hat Subscription Manager
(10) OVAL content broke for " fixing keeping system up2date"
(11) Create table that lists STIG items that do not have OVAL check
(12)
More information about the scap-security-guide
mailing list