EXTERNAL: Re: SECSCN and all_rules profile

Shawn Wells shawn at redhat.com
Tue Nov 19 00:01:13 UTC 2013


On 11/12/13, 4:49 PM, Kordell, Luke T wrote:
> Thank you for all the useful feedback! I am actually comparing the SCAP rules against SECSCNcontrols that have already been selected. My team may choose to utilize  additional SCAP scans as we see fit, but my minimum requirements are somewhat straight-forward. I realize that many of the controls are open to interpretation but I think in some of these cases a series of SCAP rules can be called to check all aspects. For instance one of our user account configuration control requirements can be covered by calling two SCAP rules. I know this may not work in all cases, but to me it's worth putting in the time to connect all the dots. In some situations SCAP seems more precise than SECSCN which can make the two difficult to compare.

How'd the comparison go? Many parties would love to read your comments!


More information about the scap-security-guide mailing list