SSG line item references
Jeffrey Blank
blank at eclipse.ncsc.mil
Tue Aug 20 14:35:47 UTC 2013
There is an attempt in
scap-security-guide/RHEL6/input/auxiliary/stig_overlay.xml.
To advance the conversation, what are you trying to build? I'm open to
making more transforms, to create specialized tables for SRTM-style docs.
David, Leland, Shawn, I think it makes sense to get together for a call
early next week on this. Can one of you invite?
On 08/19/2013 05:56 PM, Robert Sanders wrote:
> Thanks Jeff. I concur wholeheartedly with not using the x.y.z references. I haven't seen a overlay for DISA STIG <-> SSG Rule maping, is this internal to DISA or buried somewhere in the SSG?
>
> -Rob
>
> ________________________________________
> From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Jeffrey Blank [blank at eclipse.ncsc.mil]
> Sent: Monday, August 19, 2013 5:50 PM
> To: scap-security-guide at lists.fedorahosted.org
> Subject: Re: SSG line item references
>
> The Rule id (the id attribute) in SSG is your best bet for a stable
> identifier. This is what Profiles use to reference Rules, too. The
> x.y.z-style section numbers may change at any time and they should not
> be used as references.
>
> I will shortly be posting a table that shows the ID in human readable form.
>
> The STIG "overlay" should provide linkage between the issued DISA IDs
> (randomly assigned numbers), but I do not know if this is accurate at
> present. Maintaining transparent, reproducible linkage between the SSG
> upstream and the issued STIG remains a goal.
>
> It may be worth revisiting, with DISA, the idea of the STIG as a Profile
> in SSG instead of this overlay construct.
>
>
>
>
> On 08/19/2013 10:59 AM, Robert Sanders wrote:
>> Quick question - I'm looking at the SSG content files and trying to
>> determine the 'line item' number for a particular check. The DISA STIG
>> content is layed out so that the line item information (i.e.,
>> rhel-06-0000001) is inline with a particular check. The SSG content
>> doesn't appear to have this inline, and I suspect that the line items
>> are being generated programmatically via the oscap command but I haven't
>> drilled down to see what oscap is actually doing. Considering that the
>> SSG is the upstream document for the RHEL6 STIG - is DISA responsible
>> for remapping the SSG items to the STIG items, or will DISA adopt the
>> way that the SSG is generating line items? If the latter, could this
>> result in line item x.z.y from version A be a *very* different best than
>> line item x.y.z from version B?
>>
>> -Rob
>>
>>
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
--
___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance
More information about the scap-security-guide
mailing list