SSG line item references

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Aug 19 21:50:56 UTC 2013


The Rule id (the id attribute) in SSG is your best bet for a stable
identifier. This is what Profiles use to reference Rules, too.  The
x.y.z-style section numbers may change at any time and they should not
be used as references.

I will shortly be posting a table that shows the ID in human readable form.

The STIG "overlay" should provide linkage between the issued DISA IDs
(randomly assigned numbers), but I do not know if this is accurate at
present.  Maintaining transparent, reproducible linkage between the SSG
upstream and the issued STIG remains a goal.

It may be worth revisiting, with DISA, the idea of the STIG as a Profile
in SSG instead of this overlay construct.




On 08/19/2013 10:59 AM, Robert Sanders wrote:
> Quick question - I'm looking at the SSG content files and trying to
> determine the 'line item' number for a particular check.  The DISA STIG
> content is layed out so that the line item information (i.e.,
> rhel-06-0000001) is inline with a particular check.  The SSG content
> doesn't appear to have this inline, and I suspect that the line items
> are being generated programmatically via the oscap command but I haven't
> drilled down to see what oscap is actually doing.  Considering that the
> SSG is the upstream document for the RHEL6 STIG - is DISA responsible
> for remapping the SSG items to the STIG items, or will DISA adopt the
> way that the SSG is generating line items?  If the latter,  could this
> result in line item x.z.y from version A be a *very* different best than
> line item x.y.z from version B?
> 
> -Rob
> 
> 
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list