Issue with PASS_MIN_DAYS validation

Stuart Green stuart.green at doccentrics.com
Fri Oct 25 09:25:58 UTC 2013


On 25/10/2013 01:47, Shawn Wells wrote:
> On 10/24/13, 2:12 PM, wm-lists wrote:
>> Shawn, Happy to contribute.  As I get it together, I'll provide what 
>> I have.  I have a PCI-DSS QSA onsite for the foreseeable future to 
>> validate what I'm doing against the PCI-DSS 2.0 standards (3.0 will 
>> be out soon enough)..
>
> If you're willing, as you create your profile, check which OVAL checks 
> you're using have been signed off. The signed off ones will have a 
> line similar to the following, somewhere in the <metadata> tags:
>> <reference source="DS" ref_id="20130928" ref_url="test_attestation" />
>
> Give the list a shout if/as you find things without signoff. It'll 
> help prioritize OVAL unit testing, especially since we'll know which 
> ones are used within your PCI profile.
>
>> I use openscap in conjunction with Red Hat Satellite for reporting 
>> purposes to validate in scope systems
> How do you manage distributing the SCAP RPMs to the clients? There's 
> been a few writeups about custom RHN channels, dropping the XCCDF into 
> configuration channels, etc.... very interested to see how things are 
> being done in field deployments!
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

+1  Beer from me too!


More information about the scap-security-guide mailing list