draft notes & actions from 25-OCT DoD call

Shawn Wells shawn at redhat.com
Thu Oct 25 18:25:04 UTC 2012


Here are the notes that Michele and I took during the call. Before I 
send to a wider list (gov-sec, mil-oss, etc) what'd I forget? Also using 
this list to generate action items.


Procedural Next Steps:
(1) Flurry of activity today to finalize severity ratings, services, etc.
(2) Shawn to generate a "STIG Informal Draft RC1" RPM. Perhaps using a 
more clever name.
(3) DISA FSO to publicly publish a "Informal Draft" by 7-NOV. This draft 
will include prose only -- no automation.
(4) DISA FSO to publicly publish a "Formal Draft" by 26-DEC. Still no 
automation.
(5) Public comment period on "Formal Draft" ends on 17-DEC
(6) Once comments are included/requirements formalized by DISA FSO, OVAL 
content review begins 9-JAN
(7) DSAWG (sp?) review 12/13-FEB
(8) Delivery of OVAL to government in April
(9) Final RHEL6 STIG, including automation, ~20-MAY-2013


Required changes based on 25-OCT DoD Consensus Call:
(1) Need to remove notes about network services.
(2) Change banner severity to medium. Strong feedback from DoD community 
this must be medium for legal requirements
(3) SELinux should never be disabled, but permissive could be OK. Need 
to update wording. Need to include prose around how to disable specific 
enforcement types to allow SELinux to remain enforcing while unenforcing 
select apps.
(4) Re-enforce RHEL6 STIG should not mandate a host security tool. 
Double check wording AND OVAL of existing content
(5) GEN 1780 still applies? Need decision
(6) System Security Daemon content
(7) Add OVAL check for recursive filesystem walks to only check local 
filesystems, otherwise locks machine. Michele thinks xdev will do the trick.
(8) Remove the V-7 check or add language somehow indicating it's OK to 
run RHNSD when connecting to Satellite
(9) Add content for RHSM, Red Hat Subscription Manager
(10) OVAL content broke for " fixing keeping system up2date"
(11) Create table that lists STIG items that do not have OVAL check
(12)


More information about the scap-security-guide mailing list