Possibility of Fedora SCAP content to be served by SCAP security guide repository (either as subdirectory or via separated branch)?

Moessbauer, David david.moessbauer at progeny.net
Tue Sep 3 22:25:23 UTC 2013


A crucial piece of the current C&A Package is the need to appropriately identify any vulnerabilities found via scans, inclusive of the CAT level, both of which are identified in the STIG.  Aside from this, the STIG ID provides means to identify the IAC of a given vulnerability as well.

CCI mapping would help, however, as these are not unique, it does not fully accomplish the task at hand.

Speaking as one that completes C&A Packages for purposes of ATO acquisition, I would argue that this is a critical mapping.

v/r
 
David Moessbauer
(410) 627-5633 (M)
 
The Information contained in or attached to this communication may be confidential and privileged proprietary intended only for the individual/s or entity to whom/which it is addressed. Any unauthorized use, distribution, copying or disclosure of this information is strictly prohibited. If you have received this communication in error please contact the sender immediately and delete from your system.


-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: Tuesday, September 03, 2013 3:25 PM
Cc: scap-security-guide at lists.fedorahosted.org
Subject: Re: Possibility of Fedora SCAP content to be served by SCAP security guide repository (either as subdirectory or via separated branch)?

On 9/3/13 2:22 PM, Moessbauer, David wrote:
> Is there a matrix that can be referenced that will map the DISA 
> STIG-ID (or Group ID) to the CCE Audit IDs?  ...or any other mapping 
> that can be deduced
>
> In Example:
> Group ID (Vulid):  V-38487
> Group Title:  SRG-OS-000103
> Rule ID:  SV-50288r1_rule
> Rule Version (STIG-ID):  RHEL-06-000015


That metadata hasn't been added... to be honest, nobody has found the mappings meaningful enough to do. Can you help us understand how it'd benefit you?

Right now SSG rules are mapped back to the CCIs through various <ref> tags, e.g.:
<ref nist="AC-6,AU-9" disa="22,32" />

We could easily extend this to include a "stigid" name-pair value, should (a) the community be convinced this would help end-users, and (b) volunteers to perform the mapping _______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list