mappings to DISA STIG identifiers

Burns, Robert K (US SSA) robert.burns at baesystems.com
Wed Sep 4 22:14:37 UTC 2013


Here is my mapping.  CSV, just cut and paste.

Regards,

Robert K. Burns
Navy Validator

SCAP_ID,Rule_Ver
RHEL-06-000526,service_autofs_disabled
RHEL-06-000525,enable_auditd_bootloader
RHEL-06-000524,
RHEL-06-000036,userowner_gshadow_file
RHEL-06-000523,
RHEL-06-000522,
RHEL-06-000521,
RHEL-06-000519,rpm_verify_hashes
RHEL-06-000037,groupowner_gshadow_file
RHEL-06-000038,perms_gshadow_file
RHEL-06-000039,userowner_passwd_file
RHEL-06-000040,groupowner_passwd_file
RHEL-06-000518,rpm_verify_permissions
RHEL-06-000517,
RHEL-06-000516,
RHEL-06-000001,partition_for_tmp
RHEL-06-000002,partition_for_var
RHEL-06-000041,file_permissions_etc_passwd
RHEL-06-000042,userowner_group_file
RHEL-06-000043,groupowner_group_file
RHEL-06-000515,
RHEL-06-000044,perms_group_file
RHEL-06-000514,
RHEL-06-000003,partition_for_var_log
RHEL-06-000511,
RHEL-06-000045,file_permissions_library_dirs
RHEL-06-000046,file_ownership_library_dirs
RHEL-06-000004,partition_for_var_log_audit
RHEL-06-000510,configure_auditd_space_left_action
RHEL-06-000047,file_permissions_binary_dirs
RHEL-06-000005,configure_auditd_space_left_action
RHEL-06-000509,
RHEL-06-000048,file_ownership_binary_dirs
RHEL-06-000007,partition_for_home
RHEL-06-000508,
RHEL-06-000050,password_min_len
RHEL-06-000008,ensure_redhat_gpgkey_installed
RHEL-06-000051,password_min_age
RHEL-06-000009,service_rhnsd_disabled
RHEL-06-000053,password_max_age
RHEL-06-000054,password_warn_age
RHEL-06-000011,security_patches_up_to_date
RHEL-06-000056,password_require_digits
RHEL-06-000013,ensure_gpgcheck_globally_activated
RHEL-06-000507,
RHEL-06-000506,
RHEL-06-000505,
RHEL-06-000015,ensure_gpgcheck_never_disabled
RHEL-06-000504,
RHEL-06-000016,package_aide_installed
RHEL-06-000503,kernel_module_usb-storage_disabled
RHEL-06-000019,no_rsh_trust_files
RHEL-06-000027,restrict_root_console_logins
RHEL-06-000385,
RHEL-06-000028,restrict_serial_port_logins
RHEL-06-000384,
RHEL-06-000029,
RHEL-06-000030,no_empty_passwords
RHEL-06-000383,audit_logs_permissions
RHEL-06-000031,no_hashes_outside_shadow
RHEL-06-000032,no_uidzero_except_root
RHEL-06-000357,deny_password_attempts_fail_interval
RHEL-06-000033,userowner_shadow_file
RHEL-06-000034,groupowner_shadow_file
RHEL-06-000035,perms_shadow_file
RHEL-06-000082,disable_sysctl_ipv4_ip_forward
RHEL-06-000117,enable_ip6tables
RHEL-06-000120,set_iptables_default_rule
RHEL-06-000124,disable_protocol_dccp
RHEL-06-000125,disable_protocol_sctp
RHEL-06-000126,disable_protocol_rds
RHEL-06-000127,disable_protocol_tipc
RHEL-06-000133,userowner_rsyslog_files
RHEL-06-000134,groupowner_rsyslog_files
RHEL-06-000136,rsyslog_send_messages_to_logserver
RHEL-06-000137,rsyslog_send_messages_to_logserver
RHEL-06-000167,audit_rules_time_settimeofday
RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route
RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000169,audit_rules_time_stime
RHEL-06-000086,set_sysctl_net_ipv4_conf_all_accept_redirects
RHEL-06-000171,audit_rules_time_clock_settime
RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians
RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route
RHEL-06-000173,audit_rules_time_watch_localtime
RHEL-06-000174,audit_account_changes
RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects
RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects
RHEL-06-000175,audit_account_changes
RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts
RHEL-06-000176,audit_account_changes
RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses
RHEL-06-000177,audit_account_changes
RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies
RHEL-06-000182,audit_network_modifications
RHEL-06-000183,audit_mac_changes
RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter
RHEL-06-000184,audit_rules_dac_modification_chmod
RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter
RHEL-06-000185,audit_rules_dac_modification_chown
RHEL-06-000098,disable_ipv6_module_loading
RHEL-06-000186,audit_rules_dac_modification_fchmod
RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects
RHEL-06-000103,enable_ip6tables
RHEL-06-000187,audit_rules_dac_modification_fchmodat
RHEL-06-000106,enable_ip6tables
RHEL-06-000188,audit_rules_dac_modification_fchown
RHEL-06-000107,enable_ip6tables
RHEL-06-000189,audit_rules_dac_modification_fchownat
RHEL-06-000113,enable_ip6tables
RHEL-06-000190,audit_rules_dac_modification_fremovexattr
RHEL-06-000191,audit_rules_dac_modification_fsetxattr
RHEL-06-000192,audit_rules_dac_modification_lchown
RHEL-06-000193,audit_rules_dac_modification_lremovexattr
RHEL-06-000116,enable_ip6tables
RHEL-06-000194,audit_rules_dac_modification_lsetxattr
RHEL-06-000195,audit_rules_dac_modification_removexattr
RHEL-06-000196,audit_rules_dac_modification_setxattr
RHEL-06-000197,audit_file_access
RHEL-06-000198,audit_privileged_commands
RHEL-06-000199,audit_media_exports
RHEL-06-000057,password_require_uppercases
RHEL-06-000058,password_require_specials
RHEL-06-000059,password_require_lowercases
RHEL-06-000060,password_require_diffchars
RHEL-06-000061,deny_password_attempts
RHEL-06-000062,
RHEL-06-000200,audit_file_deletions
RHEL-06-000063,set_password_hashing_algorithm_logindefs
RHEL-06-000064,set_password_hashing_algorithm_libuserconf
RHEL-06-000201,audit_sysadmin_actions
RHEL-06-000065,user_owner_grub_conf
RHEL-06-000202,audit_kernel_module_loading
RHEL-06-000066,group_owner_grub_conf
RHEL-06-000203,disable_xinetd
RHEL-06-000067,permissions_grub_conf
RHEL-06-000204,uninstall_xinetd
RHEL-06-000068,bootloader_password
RHEL-06-000069,require_singleuser_auth
RHEL-06-000206,uninstall_telnet_server
RHEL-06-000070,disable_interactive_boot
RHEL-06-000211,disable_telnet_service
RHEL-06-000071,package_screen_installed
RHEL-06-000213,uninstall_rsh-server
RHEL-06-000356,deny_password_attempts
RHEL-06-000073,set_system_login_banner
RHEL-06-000214,disable_rsh
RHEL-06-000349,smartcard_auth
RHEL-06-000078,enable_randomize_va_space
RHEL-06-000079,enable_execshield
RHEL-06-000216,disable_rexec
RHEL-06-000348,ftp_present_banner
RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects
RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects
RHEL-06-000218,disable_rlogin
RHEL-06-000220,uninstall_ypserv
RHEL-06-000221,disable_ypbind
RHEL-06-000224,enable_cron
RHEL-06-000222,uninstall_tftp-server
RHEL-06-000227,sshd_allow_only_protocol2
RHEL-06-000230,sshd_set_idle_timeout
RHEL-06-000223,disable_tftp
RHEL-06-000231,sshd_set_keepalive
RHEL-06-000234,sshd_disable_rhosts
RHEL-06-000236,disable_host_auth
RHEL-06-000237,sshd_disable_root_login
RHEL-06-000239,sshd_disable_empty_passwords
RHEL-06-000240,sshd_enable_warning_banner
RHEL-06-000241,sshd_do_not_permit_user_env
RHEL-06-000243,sshd_use_approved_ciphers
RHEL-06-000246,disable_avahi
RHEL-06-000347,no_netrc_files
RHEL-06-000247,enable_ntpd
RHEL-06-000248,ntpd_specify_remote_server
RHEL-06-000249,postfix_network_listening
RHEL-06-000135,rsyslog_file_permissions
RHEL-06-000138,ensure_logrotate_activated
RHEL-06-000252,ldap_client_start_tls
RHEL-06-000253,ldap_client_tls_cacertpath
RHEL-06-000256,package_openldap-servers_removed
RHEL-06-000145,enable_auditd_service
RHEL-06-000257,set_screensaver_inactivity_timeout
RHEL-06-000258,enable_screensaver_after_idle
RHEL-06-000148,enable_auditd_service
RHEL-06-000154,enable_auditd_service
RHEL-06-000160,configure_auditd_max_log_file
RHEL-06-000161,configure_auditd_max_log_file_action
RHEL-06-000165,audit_rules_time_adjtimex
RHEL-06-000159,configure_auditd_num_logs
RHEL-06-000281,rpm_verify_hashes
RHEL-06-000259,enable_screensaver_password_lock
RHEL-06-000260,set_blank_screensaver
RHEL-06-000261,service_abrtd_disabled
RHEL-06-000262,
RHEL-06-000346,set_daemon_umask
RHEL-06-000282,world_writeable_files
RHEL-06-000265,service_ntpdate_disabled
RHEL-06-000345,user_umask_logindefs
RHEL-06-000266,service_oddjobd_disabled
RHEL-06-000344,user_umask_profile
RHEL-06-000267,service_qpidd_disabled
RHEL-06-000343,user_umask_cshrc
RHEL-06-000268,service_rdisc_disabled
RHEL-06-000342,user_umask_bashrc
RHEL-06-000269,use_nodev_option_on_nfs_mounts
RHEL-06-000341,snmpd_not_default_password
RHEL-06-000270,use_nosuid_option_on_nfs_mounts
RHEL-06-000271,mountopt_noexec_on_removable_partitions
RHEL-06-000272,require_smb_client_signing
RHEL-06-000273,require_smb_client_signing_mount.cifs
RHEL-06-000274,limiting_password_reuse
RHEL-06-000275,encrypt_partitions
RHEL-06-000340,snmpd_use_newer_protocol
RHEL-06-000276,encrypt_partitions
RHEL-06-000277,encrypt_partitions
RHEL-06-000278,rpm_verify_permissions
RHEL-06-000279,
RHEL-06-000280,
RHEL-06-000284,install_antivirus
RHEL-06-000285,install_hids
RHEL-06-000286,disable_ctrlaltdel_reboot
RHEL-06-000287,service_postfix_enable
RHEL-06-000306,aide_periodic_cron_checking
RHEL-06-000288,package_sendmail_removed
RHEL-06-000289,service_netconsole_disabled
RHEL-06-000307,aide_periodic_cron_checking
RHEL-06-000290,disable_xwindows_with_runlevel
RHEL-06-000308,disable_users_coredumps
RHEL-06-000291,packagegroup_xwindows_remove
RHEL-06-000309,no_insecure_locks_exports
RHEL-06-000311,configure_auditd_space_left_action
RHEL-06-000292,disable_dhcp_client
RHEL-06-000313,configure_auditd_action_mail_acct
RHEL-06-000294,gid_passwd_group_same
RHEL-06-000315,kernel_module_bluetooth_disabled
RHEL-06-000296,account_unique_name
RHEL-06-000319,max_concurrent_login_sessions
RHEL-06-000297,account_temp_expire_date
RHEL-06-000320,set_iptables_default_rule_forward
RHEL-06-000321,install_openswan
RHEL-06-000324,enable_gdm_login_banner
RHEL-06-000326,
RHEL-06-000298,account_temp_expire_date
RHEL-06-000331,service_bluetooth_disabled
RHEL-06-000334,account_disable_post_pw_expiration
RHEL-06-000299,password_require_consecrepeat
RHEL-06-000335,account_disable_post_pw_expiration
RHEL-06-000302,aide_periodic_cron_checking
RHEL-06-000303,aide_periodic_cron_checking
RHEL-06-000336,sticky_world_writable_dirs
RHEL-06-000304,aide_periodic_cron_checking
RHEL-06-000337,world_writable_files_system_ownership
RHEL-06-000305,aide_periodic_cron_checking
RHEL-06-000338,tftpd_uses_secure_mode
RHEL-06-000339,ftp_log_transactions



-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Moessbauer, David
Sent: Wednesday, September 04, 2013 4:18 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: RE: Re: mappings to DISA STIG identifiers

Thanks that is the exact kind of artifact I was looking for - though I do understand that its current state may not be 4.0.

Regarding the NIST controls; yes I know this is eventually coming down the pike (at least as of last I heard), but there is a need to address accreditations in the interim.   And as the Navy is my branch of interest,  I expect it may still be a little while until these controls are fully replaced.

If in the future this also included the NIST controls, that would be very helpful in POA&M transitions to the newer controls.

V/r

David W. Moessbauer
System Engineer
Progeny Systems Corporation
david.moessbauer at progeny.net
SIPR: david.moessbauer.ctr at progeny.spawar-chas.navy.smil.mil
(410) 627-5633 (M)
(703) 368-6107 x315 (O) / x125 (lab)

Sent from my Verizon Wireless 4G LTE Smartphone


-------- Original message --------
From: Jeffrey Blank <blank at eclipse.ncsc.mil>
Date: 09/03/2013 23:13 (GMT-05:00)
To: scap-security-guide at lists.fedorahosted.org
Subject: (nwl) Re: mappings to DISA STIG identifiers


Ah, gotcha.

I can't find the authoritative memo that says so (DIARMF-related?), but what I'd been hearing for a while is that the DoD will be adopting the NIST 800-53 controls (via CNSS 1253).  Can anyone else speak to this from the policy angle?  I assume this is why the older DoD IA controls are not explicitly included with the RHEL 6 STIG. I assume this represents represents DoD thinking (11 months ago, anyway):
http://csrc.nist.gov/groups/SMA/ispab/documents/minutes/2012-10/ispab_oct2012_dcussatt_dod-rmf-transition-brief.pdf

As for such a table, we're generating something similar already:
http://scap-securityguide.rhcloud.com/RHEL6/output/table-stig-rhel6.html

However, the STIG-related references here likely aren't accurate, as we haven't account for any changes made by FSO, so I can't recommend using this yet.  Once we can synchronize with them and establish the undesirability of any future private changes, it should be possible to scalably reduce costs for C&A activities by providing such commonly-used tables in the project.





On Tue, Sep 3, 2013 at 10:08 PM, Moessbauer, David <david.moessbauer at progeny.net> wrote:
> At a minimum, I would suggest that such a table would contain
>
> a unique identifier such as the Group ID (Vulid) or the Rule Version 
> (STIG-ID), the CCE number currently detailed in the SCAP results and 
> the Severity (CAT).
>
> With this all can be easily linked back to the pertinent STIG.  The IA 
> Control was also presented in the prior iteration of the UNIX 
> Checklist and earlier versions of the RHEL5 XCCDF.
>
>
> An IAC is the 'Information Assurance Control' as defined in DoDD 
> 8500.01 and enumerated in DoDI 8500.2.
>
> The definition detailed in paragraph E2.1.19 of Directive states that 
> "an IA Control is an objective IA condition of integrity, availability 
> or confidentiality achieved through the application of specific 
> safeguards or through the regulation of specific activities that is 
> expressed in a specified format, i.e., a control number, a control 
> name, control text, and a control class. Specific management, 
> personnel, operational, and technical controls are applied to each DoD 
> information system to achieve an appropriate level of integrity, 
> availability, and confidentiality in accordance with reference"
>
> The following is an excerpt of a couple of them as displayed in this 
> Instruction, where the 5 digit identifier is the IAC (IE: 'DCCB-2')
>
> DCCB-2 Control Board
> All information systems are under the control of a chartered 
> Configuration Control Board that meets regularly according to DCPR-1. 
> The IAM is a member of the CCB.
>
> DCCS-2 Configuration Specifications
> A DoD reference document such as a security technical implementation 
> guide or security recommendation guide constitutes the primary source 
> for security configuration or implementation guidance for the 
> deployment of newly acquired IA- and IA-enabled IT products that 
> require use of the product's IA capabilities. If a DoD reference 
> document is not available, the system owner works with DISA or NSA to 
> draft configuration guidance for inclusion in a Departmental reference 
> guide.
>
> DCCT-1 Compliance Testing
> A comprehensive set of procedures is implemented that tests all 
> patches, upgrades, and new AIS applications prior to deployment.
>
>
> BTW:  apologize for my prior hijacking of subject lineā€¦
>
> v/r
>
> David Moessbauer
> (410) 627-5633 (M)
>
> The Information contained in or attached to this communication may be 
> confidential and privileged proprietary intended only for the 
> individual/s or entity to whom/which it is addressed. Any unauthorized 
> use, distribution, copying or disclosure of this information is 
> strictly prohibited. If you have received this communication in error 
> please contact the sender immediately and delete from your system.
>
>
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org
> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf 
> Of Jeffrey Blank
> Sent: Tuesday, September 03, 2013 9:30 PM
> To: scap-security-guide at lists.fedorahosted.org
> Subject: (nwl) mappings to DISA STIG identifiers
>
> I have started a new subject/thread for this discussion.
>
> Please note: Subscribers to the list should never reply to any 
> message, particularly one with a complex subject, and move to an 
> off-topic discussion.  It quickly results in confusion for mail 
> clients which perform threaded display, as well as the list's web archives.
>
> As to David's question, there has been some informal discussion, but 
> we have also not fully settled on how to do this.  This will be a 
> topic of an upcoming discussion, and it will also be key to ensuring 
> that there is good correspondence between the STIG profile in SSG and 
> the STIG which FSO releases.
>
> The CAT level should be identified as Severity (and this should be 
> present in scan results).
>
> Assuming your desired output is a table, can you describe what columns 
> would be in it?
>
> What's an IAC?
>
>
>
> On Tue, Sep 3, 2013 at 6:25 PM, Moessbauer, David 
> <david.moessbauer at progeny.net> wrote:
>> A crucial piece of the current C&A Package is the need to 
>> appropriately identify any vulnerabilities found via scans, inclusive 
>> of the CAT level, both of which are identified in the STIG.  Aside 
>> from this, the STIG ID provides means to identify the IAC of a given vulnerability as well.
>>
>> CCI mapping would help, however, as these are not unique, it does not 
>> fully accomplish the task at hand.
>>
>> Speaking as one that completes C&A Packages for purposes of ATO 
>> acquisition, I would argue that this is a critical mapping.
>>
>> v/r
>>
>> David Moessbauer
>> (410) 627-5633 (M)
>>
>> The Information contained in or attached to this communication may be 
>> confidential and privileged proprietary intended only for the 
>> individual/s or entity to whom/which it is addressed. Any 
>> unauthorized use, distribution, copying or disclosure of this 
>> information is strictly prohibited. If you have received this 
>> communication in error please contact the sender immediately and delete from your system.
>>
>>
>> -----Original Message-----
>> From: scap-security-guide-bounces at lists.fedorahosted.org
>> [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf 
>> Of Shawn Wells
>> Sent: Tuesday, September 03, 2013 3:25 PM
>> Cc: scap-security-guide at lists.fedorahosted.org
>> Subject: Re: Possibility of Fedora SCAP content to be served by SCAP 
>> security guide repository (either as subdirectory or via separated branch)?
>>
>> On 9/3/13 2:22 PM, Moessbauer, David wrote:
>>> Is there a matrix that can be referenced that will map the DISA 
>>> STIG-ID (or Group ID) to the CCE Audit IDs?  ...or any other mapping 
>>> that can be deduced
>>>
>>> In Example:
>>> Group ID (Vulid):  V-38487
>>> Group Title:  SRG-OS-000103
>>> Rule ID:  SV-50288r1_rule
>>> Rule Version (STIG-ID):  RHEL-06-000015
>>
>>
>> That metadata hasn't been added... to be honest, nobody has found the 
>> mappings meaningful enough to do. Can you help us understand how it'd 
>> benefit you?
>>
>> Right now SSG rules are mapped back to the CCIs through various <ref> 
>> tags, e.g.:
>> <ref nist="AC-6,AU-9" disa="22,32" />
>>
>> We could easily extend this to include a "stigid" name-pair value, 
>> should (a) the community be convinced this would help end-users, and
>> (b) volunteers to perform the mapping 
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list