Definition Criteria ...

Trey Henefield trey.henefield at ultra-ats.com
Thu Aug 29 16:13:15 UTC 2013


Greetings,

So I am still in the learning process and am currently creating my own SSG benchmark for Java.

Given that there are numerous iterations of Java (i.e. java-1.6.0-sun, java-1.7.0-oracle, ibm, openjdk) and different install paths (/etc/alternatives/jre_oracle, /etc/alternatives/jre_sun), I am attempting to produce the appropriate criteria to account for all types.

While typically one would only go with one particular type of java, I would like to ensure that if more than one type is installed, that I capture compliance for everyone.

However, I am having trouble grasping the concept of the criteria (AND, OR, ONE, XOR) and how best to use each in the proper hierarchy to achieve my goal.

I can't seem to find any good information that breaks down each of these and their intended outcome.

Now obviously if you have more than one definition underneath AND, the requirement is that all equate to true.

So to achieve my suggested goal, my thoughts were the following for cpe-oval:

<AND>
               Def.UNIX
               <OR>
                              Def.JRE-SUN
               <OR>
                              Def.JRE-ORACLE
               ...

That seems to work, but the criteria for the actual checks seem to get a little more grey.

My thoughts were:

<OR>
               TST.JRE-SUN-INSTALLED
               <AND>
TST.JRE-SUN-CHECK
               TST.JRE-ORACLE-INSTALLED
               <AND>
TST.JRE-ORACLE-CHECK

But that doesn't seem to pan out the way I expected it to.

Any thoughts on how best to accomplish this?

Thaks!

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com

Disclaimer
The information contained in this communication from trey.henefield at ultra-ats.com sent at 2013-08-29 12:13:20 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide at lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide at lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130829/4add6b33/attachment.html>


More information about the scap-security-guide mailing list