mappings to DISA STIG identifiers

Trey Henefield trey.henefield at ultra-ats.com
Mon Sep 9 16:34:26 UTC 2013


I think it would be awesome if there were a way to link to an existing STIG ID.

It is very difficult to map between the SSG RHEL6 content and the official RHEL6 STIG.

From my experience so far, I have noticed that the resulting content will open in the STIG Viewer application, but because it uses designated identifiers for Group ID and Rule ID, it doesn’t display identical to the original STIG. Also, there are a number of fields that a standard STIG uses that indicates how data gets displayed in the display window. So the content I produce just has the default “Documentable: No” field and that’s it.

Furthermore, I believe to be able to import scan results into an existing STIG Checklist created in the STIG Viewer, the Group ID and Rule ID fields would need to match between the original STIG and the resulting SCAP content.

It would be nice to have one zip file that can serve as both the STIG Viewer content and SCAP content.

However, I also like the simplified naming approach of each rule in SSG (e.g. banner_gui_enabled) as it is easier to maintain as opposed to the Rule IDs in the STIG (e.g. SV-50255r1_rule).

Also, if you change the Group ID up front, then it affects the layout of the guide.

Perhaps we could include a “STIG ID”, “STIG Group ID” and “STIG Rule ID” for each rule that can later be used when building the SCAP content to use the STIG identifiers. That would at least resolve the mappings.

So taking a random check that I found in both, here are the mappings as I see it:

STIG                                                                   --> SSG

Group ID (V-38541)                                        --> Group ID (auditd_configure_rules)
Group ID Title (SRG-OS-999999)                  --> Group ID Title (Configure auditd Rules for Comprehensive Auditing)
Rule ID (SV-50342r1_rule)                            --> Rule ID (audit_mac_changes)
Rule ID Version (RHEL-06-000183)             --> Rule ID Version (does not exist and is not a valid SCAP element)

I believe the “Group ID Title” and “Rule ID Version” are just cosmetic and could likely be left out. Although it would still be nice to pull in the “Rule ID Version” field as a STIG ID reference.

But it would be nice to be able to convert SSG Group ID and Rule ID to their STIG values during build time. I believe this conversion would also need to be done in the profiles as well, since they call the rules to be enabled.

As for the extra content, I have not had much luck in finding a good way of incorporating that. Here is an example of the “extra content” I am referring to using the same referenced check above:

<description>&lt;VulnDiscussion&gt;The system's mandatory access policy (SELinux) should not be arbitrarily changed by anything other than administrator action. All changes to MAC policy should be audited.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;&lt;/Responsibility&gt;&lt;IAControls&gt;&lt;/IAControls&gt;</description>

Best regards,

Trey Henefield, CISSP
Senior IAVA Engineer

Ultra Electronics
Advanced Tactical Systems, Inc.
4101 Smith School Road
Building IV, Suite 100
Austin, TX 78744 USA

Trey.Henefield at ultra-ats.com
Tel: +1 512 327 6795 ext. 647
Fax: +1 512 327 8043
Mobile: +1 512 541 6450

www.ultra-ats.com

From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: Monday, September 09, 2013 10:18 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: mappings to DISA STIG identifiers

On 9/5/13 12:09 PM, Burns, Robert K (US SSA) wrote:

A couple of corrections, version 1.1.



Regards,



Robert K. Burns

Navy Validator

Robert.burns at baesystems.com<mailto:Robert.burns at baesystems.com>



Rule_Ver,SCAP_ID

RHEL-06-000526,service_autofs_disabled

RHEL-06-000525,enable_auditd_bootloader

RHEL-06-000524,

RHEL-06-000036,userowner_gshadow_file

RHEL-06-000523,

RHEL-06-000522,

RHEL-06-000521,

RHEL-06-000519,rpm_verify_hashes

RHEL-06-000037,groupowner_gshadow_file

RHEL-06-000038,perms_gshadow_file

RHEL-06-000039,userowner_passwd_file

RHEL-06-000040,groupowner_passwd_file

RHEL-06-000518,rpm_verify_permissions

RHEL-06-000517,

RHEL-06-000516,

RHEL-06-000001,partition_for_tmp

RHEL-06-000002,partition_for_var

RHEL-06-000041,file_permissions_etc_passwd

RHEL-06-000042,userowner_group_file

RHEL-06-000043,groupowner_group_file

RHEL-06-000515,

RHEL-06-000044,perms_group_file

RHEL-06-000514,

RHEL-06-000003,partition_for_var_log

RHEL-06-000511,

RHEL-06-000045,file_permissions_library_dirs

RHEL-06-000046,file_ownership_library_dirs

RHEL-06-000004,partition_for_var_log_audit

RHEL-06-000510,configure_auditd_space_left_action

RHEL-06-000047,file_permissions_binary_dirs

RHEL-06-000005,configure_auditd_space_left_action

RHEL-06-000509,

RHEL-06-000048,file_ownership_binary_dirs

RHEL-06-000007,partition_for_home

RHEL-06-000508,

RHEL-06-000050,password_min_len

RHEL-06-000008,ensure_redhat_gpgkey_installed

RHEL-06-000051,password_min_age

RHEL-06-000009,service_rhnsd_disabled

RHEL-06-000053,password_max_age

RHEL-06-000054,password_warn_age

RHEL-06-000011,security_patches_up_to_date

RHEL-06-000056,password_require_digits

RHEL-06-000013,ensure_gpgcheck_globally_activated

RHEL-06-000507,

RHEL-06-000506,

RHEL-06-000505,

RHEL-06-000015,ensure_gpgcheck_never_disabled

RHEL-06-000504,

RHEL-06-000016,package_aide_installed

RHEL-06-000503,kernel_module_usb-storage_disabled

RHEL-06-000019,no_rsh_trust_files

RHEL-06-000027,restrict_root_console_logins

RHEL-06-000385,

RHEL-06-000028,restrict_serial_port_logins

RHEL-06-000384,

RHEL-06-000029,

RHEL-06-000030,no_empty_passwords

RHEL-06-000383,audit_logs_permissions

RHEL-06-000031,no_hashes_outside_shadow

RHEL-06-000032,no_uidzero_except_root

RHEL-06-000357,deny_password_attempts_fail_interval

RHEL-06-000033,userowner_shadow_file

RHEL-06-000034,groupowner_shadow_file

RHEL-06-000035,perms_shadow_file

RHEL-06-000082,disable_sysctl_ipv4_ip_forward

RHEL-06-000117,enable_ip6tables

RHEL-06-000120,set_iptables_default_rule

RHEL-06-000124,disable_protocol_dccp

RHEL-06-000125,disable_protocol_sctp

RHEL-06-000126,disable_protocol_rds

RHEL-06-000127,disable_protocol_tipc

RHEL-06-000133,userowner_rsyslog_files

RHEL-06-000134,groupowner_rsyslog_files

RHEL-06-000136,rsyslog_send_messages_to_logserver

RHEL-06-000137,rsyslog_send_messages_to_logserver

RHEL-06-000167,audit_rules_time_settimeofday

RHEL-06-000083,set_sysctl_net_ipv4_conf_all_accept_source_route

RHEL-06-000084,set_sysctl_net_ipv4_conf_all_accept_redirects

RHEL-06-000169,audit_rules_time_stime

RHEL-06-000086,set_sysctl_net_ipv4_conf_all_secure_redirects

RHEL-06-000171,audit_rules_time_clock_settime

RHEL-06-000088,set_sysctl_net_ipv4_conf_all_log_martians

RHEL-06-000089,set_sysctl_net_ipv4_conf_default_accept_source_route

RHEL-06-000173,audit_rules_time_watch_localtime

RHEL-06-000174,audit_account_changes

RHEL-06-000090,set_sysctl_net_ipv4_conf_default_secure_redirects

RHEL-06-000091,set_sysctl_net_ipv4_conf_default_accept_redirects

RHEL-06-000175,audit_account_changes

RHEL-06-000092,set_sysctl_net_ipv4_icmp_echo_ignore_broadcasts

RHEL-06-000176,audit_account_changes

RHEL-06-000093,set_sysctl_net_ipv4_icmp_ignore_bogus_error_responses

RHEL-06-000177,audit_account_changes

RHEL-06-000095,set_sysctl_net_ipv4_tcp_syncookies

RHEL-06-000182,audit_network_modifications

RHEL-06-000183,audit_mac_changes

RHEL-06-000096,set_sysctl_net_ipv4_conf_all_rp_filter

RHEL-06-000184,audit_rules_dac_modification_chmod

RHEL-06-000097,set_sysctl_net_ipv4_conf_default_rp_filter

RHEL-06-000185,audit_rules_dac_modification_chown

RHEL-06-000098,disable_ipv6_module_loading

RHEL-06-000186,audit_rules_dac_modification_fchmod

RHEL-06-000099,set_sysctl_ipv6_default_accept_redirects

RHEL-06-000103,enable_ip6tables

RHEL-06-000187,audit_rules_dac_modification_fchmodat

RHEL-06-000106,enable_ip6tables

RHEL-06-000188,audit_rules_dac_modification_fchown

RHEL-06-000107,enable_ip6tables

RHEL-06-000189,audit_rules_dac_modification_fchownat

RHEL-06-000113,enable_iptables

RHEL-06-000190,audit_rules_dac_modification_fremovexattr

RHEL-06-000191,audit_rules_dac_modification_fsetxattr

RHEL-06-000192,audit_rules_dac_modification_lchown

RHEL-06-000193,audit_rules_dac_modification_lremovexattr

RHEL-06-000116,enable_ip6tables

RHEL-06-000194,audit_rules_dac_modification_lsetxattr

RHEL-06-000195,audit_rules_dac_modification_removexattr

RHEL-06-000196,audit_rules_dac_modification_setxattr

RHEL-06-000197,audit_file_access

RHEL-06-000198,audit_privileged_commands

RHEL-06-000199,audit_media_exports

RHEL-06-000057,password_require_uppercases

RHEL-06-000058,password_require_specials

RHEL-06-000059,password_require_lowercases

RHEL-06-000060,password_require_diffchars

RHEL-06-000061,deny_password_attempts

RHEL-06-000062,pass set_password_hashing_algorithm_systemauth

RHEL-06-000200,audit_file_deletions

RHEL-06-000063,set_password_hashing_algorithm_logindefs

RHEL-06-000064,set_password_hashing_algorithm_libuserconf

RHEL-06-000201,audit_sysadmin_actions

RHEL-06-000065,user_owner_grub_conf

RHEL-06-000202,audit_kernel_module_loading

RHEL-06-000066,group_owner_grub_conf

RHEL-06-000203,disable_xinetd

RHEL-06-000067,permissions_grub_conf

RHEL-06-000204,uninstall_xinetd

RHEL-06-000068,bootloader_password

RHEL-06-000069,require_singleuser_auth

RHEL-06-000206,uninstall_telnet_server

RHEL-06-000070,disable_interactive_boot

RHEL-06-000211,disable_telnet_service

RHEL-06-000071,package_screen_installed

RHEL-06-000213,uninstall_rsh-server

RHEL-06-000356,deny_password_attempts

RHEL-06-000073,set_system_login_banner

RHEL-06-000214,disable_rsh

RHEL-06-000349,smartcard_auth

RHEL-06-000078,enable_randomize_va_space

RHEL-06-000079,enable_execshield

RHEL-06-000216,disable_rexec

RHEL-06-000348,ftp_present_banner

RHEL-06-000080,disable_sysctl_ipv4_default_send_redirects

RHEL-06-000081,disable_sysctl_ipv4_all_send_redirects

RHEL-06-000218,disable_rlogin

RHEL-06-000220,uninstall_ypserv

RHEL-06-000221,disable_ypbind

RHEL-06-000224,enable_cron

RHEL-06-000222,uninstall_tftp-server

RHEL-06-000227,sshd_allow_only_protocol2

RHEL-06-000230,sshd_set_idle_timeout

RHEL-06-000223,disable_tftp

RHEL-06-000231,sshd_set_keepalive

RHEL-06-000234,sshd_disable_rhosts

RHEL-06-000236,disable_host_auth

RHEL-06-000237,sshd_disable_root_login

RHEL-06-000239,sshd_disable_empty_passwords

RHEL-06-000240,sshd_enable_warning_banner

RHEL-06-000241,sshd_do_not_permit_user_env

RHEL-06-000243,sshd_use_approved_ciphers

RHEL-06-000246,disable_avahi

RHEL-06-000347,no_netrc_files

RHEL-06-000247,enable_ntpd

RHEL-06-000248,ntpd_specify_remote_server

RHEL-06-000249,postfix_network_listening

RHEL-06-000135,rsyslog_file_permissions

RHEL-06-000138,ensure_logrotate_activated

RHEL-06-000252,ldap_client_start_tls

RHEL-06-000253,ldap_client_tls_cacertpath

RHEL-06-000256,package_openldap-servers_removed

RHEL-06-000145,enable_auditd_service

RHEL-06-000257,set_screensaver_inactivity_timeout

RHEL-06-000258,enable_screensaver_after_idle

RHEL-06-000148,enable_auditd_service

RHEL-06-000154,enable_auditd_service

RHEL-06-000160,configure_auditd_max_log_file

RHEL-06-000161,configure_auditd_max_log_file_action

RHEL-06-000165,audit_rules_time_adjtimex

RHEL-06-000159,configure_auditd_num_logs

RHEL-06-000281,rpm_verify_hashes

RHEL-06-000259,enable_screensaver_password_lock

RHEL-06-000260,set_blank_screensaver

RHEL-06-000261,service_abrtd_disabled

RHEL-06-000262,

RHEL-06-000346,set_daemon_umask

RHEL-06-000282,world_writeable_files

RHEL-06-000265,service_ntpdate_disabled

RHEL-06-000345,user_umask_logindefs

RHEL-06-000266,service_oddjobd_disabled

RHEL-06-000344,user_umask_profile

RHEL-06-000267,service_qpidd_disabled

RHEL-06-000343,user_umask_cshrc

RHEL-06-000268,service_rdisc_disabled

RHEL-06-000342,user_umask_bashrc

RHEL-06-000269,use_nodev_option_on_nfs_mounts

RHEL-06-000341,snmpd_not_default_password

RHEL-06-000270,use_nosuid_option_on_nfs_mounts

RHEL-06-000271,mountopt_noexec_on_removable_partitions

RHEL-06-000272,require_smb_client_signing

RHEL-06-000273,require_smb_client_signing_mount.cifs

RHEL-06-000274,limiting_password_reuse

RHEL-06-000275,encrypt_partitions

RHEL-06-000340,snmpd_use_newer_protocol

RHEL-06-000276,encrypt_partitions

RHEL-06-000277,encrypt_partitions

RHEL-06-000278,rpm_verify_permissions

RHEL-06-000279,

RHEL-06-000280,

RHEL-06-000284,install_antivirus

RHEL-06-000285,install_hids

RHEL-06-000286,disable_ctrlaltdel_reboot

RHEL-06-000287,service_postfix_enable

RHEL-06-000306,aide_periodic_cron_checking

RHEL-06-000288,package_sendmail_removed

RHEL-06-000289,service_netconsole_disabled

RHEL-06-000307,aide_periodic_cron_checking

RHEL-06-000290,disable_xwindows_with_runlevel

RHEL-06-000308,disable_users_coredumps

RHEL-06-000291,packagegroup_xwindows_remove

RHEL-06-000309,no_insecure_locks_exports

RHEL-06-000311,configure_auditd_space_left_action

RHEL-06-000292,disable_dhcp_client

RHEL-06-000313,configure_auditd_action_mail_acct

RHEL-06-000294,gid_passwd_group_same

RHEL-06-000315,kernel_module_bluetooth_disabled

RHEL-06-000296,account_unique_name

RHEL-06-000319,max_concurrent_login_sessions

RHEL-06-000297,account_temp_expire_date

RHEL-06-000320,set_iptables_default_rule_forward

RHEL-06-000321,install_openswan

RHEL-06-000324,enable_gdm_login_banner

RHEL-06-000326,

RHEL-06-000298,account_temp_expire_date

RHEL-06-000331,service_bluetooth_disabled

RHEL-06-000334,account_disable_post_pw_expiration

RHEL-06-000299,password_require_consecrepeat

RHEL-06-000335,account_disable_post_pw_expiration

RHEL-06-000302,aide_periodic_cron_checking

RHEL-06-000303,aide_periodic_cron_checking

RHEL-06-000336,sticky_world_writable_dirs

RHEL-06-000304,aide_periodic_cron_checking

RHEL-06-000337,world_writable_files_system_ownership

RHEL-06-000305,aide_periodic_cron_checking

RHEL-06-000338,tftpd_uses_secure_mode

RHEL-06-000339,ftp_log_transactions

Well, dang. Hell of a way to make me recant the "nobody has found the mappings meaningful enough to do" statement! :)

Existing mappings are identified within <refs> tags:


<ref nist="AC-3,AC-3(3),AC-4,AC-6,AU-9" disa="22,32"/>

Before extending XCCDF rules to include something akin to a <ref stig="338,339">, can FSO (Leland? Ricki?) chime in on how static these identifiers will be? Or, even better, could we generate them directly from SSG?

Disclaimer
The information contained in this communication from trey.henefield at ultra-ats.com sent at 2013-09-09 12:34:33 is confidential and may be legally privileged.
It is intended solely for use by scap-security-guide at lists.fedorahosted.org and others authorized to receive it. If you are not scap-security-guide at lists.fedorahosted.org you are hereby notified that
any disclosure, copying, distribution or taking action in reliance of the contents of this information is strictly prohibited and may be unlawful.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130909/6b818fe4/attachment-0001.html>


More information about the scap-security-guide mailing list