Profile Creation Rational

joescap at mm.st joescap at mm.st
Fri Dec 20 16:01:38 UTC 2013


On Fri, Dec 20, 2013, at 08:04 AM, Shawn Wells wrote:
> On 12/19/13, 11:00 AM, joescap at mm.st wrote:
> > This is just a curiosity question.  In the ssg-rhel6-xccdf.xml there are
> > several profiles listed:  common, server, stig-rhel6-server,
> > usgcb-rhel6-server among others.  I was curios how the tests for each
> > profile was selected, especially the stig-rhel6-server and
> > usgcb-rhel6-server.  Was this the consensus of a group of SMEs?  Also,
> > is there anything out there that documents why some tests were included
> > and others were not.  As I said, just curious about the process.  Thanks
> 
> STIG baselines are developed following the DoD Consensus model. DISA FSO 
> drops a list of requirements (CCIs) that we map rules against. The <ref> 
> tags are used for this purpose. Reference line 125:
> https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/system/selinux.xml
> 
> We then transform these mappings into an HTML table:
> http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig-rhel6.html
> 
> Afterwards, we hold a DoD consensus meeting which involves 
> representatives from all DoD, IC, and civilian parties. Over the course 
> of a day or two, we step through every. single. line. of that table and 
> verify all parties feel the CCI requirements are met. Some time 
> afterward, DISA generates the STIG.
> 
> The USGCB profile will be created in much the same way. Currently we're 
> performing the mappings against NIST 800-53, with the future intent to 
> validate these mappings with NIST, NSA, and other stakeholders.
> 
> Hope this helps!
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

That helps a lot, thanks.  A followup question.  Just a little confused
and want to make sure I understand.  Your comments above refer to how
the "stig-rhel6-server" profile was created?  If that is correct,
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig-rhel6.html
lists the tests that are enabled in the "stig-rhel6-server" profile? Or
are your comments referring to the baseline DISA STIG as a whole that is
available via the NIST checklist repository.  


More information about the scap-security-guide mailing list