mappings to DISA STIG identifiers

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Sep 4 01:29:48 UTC 2013


I have started a new subject/thread for this discussion.

Please note: Subscribers to the list should never reply to any
message, particularly one with a complex subject, and move to an
off-topic discussion.  It quickly results in confusion for mail
clients which perform threaded display, as well as the list's web
archives.

As to David's question, there has been some informal discussion, but
we have also not fully settled on how to do this.  This will be a
topic of an upcoming discussion, and it will also be key to ensuring
that there is good correspondence between the STIG profile in SSG and
the STIG which FSO releases.

The CAT level should be identified as Severity (and this should be
present in scan results).

Assuming your desired output is a table, can you describe what columns
would be in it?

What's an IAC?



On Tue, Sep 3, 2013 at 6:25 PM, Moessbauer, David
<david.moessbauer at progeny.net> wrote:
> A crucial piece of the current C&A Package is the need to appropriately identify any vulnerabilities found via scans, inclusive of the CAT level, both of which are identified in the STIG.  Aside from this, the STIG ID provides means to identify the IAC of a given vulnerability as well.
>
> CCI mapping would help, however, as these are not unique, it does not fully accomplish the task at hand.
>
> Speaking as one that completes C&A Packages for purposes of ATO acquisition, I would argue that this is a critical mapping.
>
> v/r
>
> David Moessbauer
> (410) 627-5633 (M)
>
> The Information contained in or attached to this communication may be confidential and privileged proprietary intended only for the individual/s or entity to whom/which it is addressed. Any unauthorized use, distribution, copying or disclosure of this information is strictly prohibited. If you have received this communication in error please contact the sender immediately and delete from your system.
>
>
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn Wells
> Sent: Tuesday, September 03, 2013 3:25 PM
> Cc: scap-security-guide at lists.fedorahosted.org
> Subject: Re: Possibility of Fedora SCAP content to be served by SCAP security guide repository (either as subdirectory or via separated branch)?
>
> On 9/3/13 2:22 PM, Moessbauer, David wrote:
>> Is there a matrix that can be referenced that will map the DISA
>> STIG-ID (or Group ID) to the CCE Audit IDs?  ...or any other mapping
>> that can be deduced
>>
>> In Example:
>> Group ID (Vulid):  V-38487
>> Group Title:  SRG-OS-000103
>> Rule ID:  SV-50288r1_rule
>> Rule Version (STIG-ID):  RHEL-06-000015
>
>
> That metadata hasn't been added... to be honest, nobody has found the mappings meaningful enough to do. Can you help us understand how it'd benefit you?
>
> Right now SSG rules are mapped back to the CCIs through various <ref> tags, e.g.:
> <ref nist="AC-6,AU-9" disa="22,32" />
>
> We could easily extend this to include a "stigid" name-pair value, should (a) the community be convinced this would help end-users, and (b) volunteers to perform the mapping _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list