scap-security-guide Digest, Vol 25, Issue 74
Shawn Wells
shawn at redhat.com
Fri Sep 27 15:51:38 UTC 2013
On 9/25/13 10:48 AM, Josh Kayse wrote:
> On 09/25/2013 10:40 AM, Saxon, William G CIV SPAWARSYSCEN-ATLANTIC,
> 58810 wrote:
>> The CTO to which David is referring is 10-17 (28 July 2010) which
>> mandates that HBSS be deployed on all Linux and Unix systems.
>>
>> I asked DISA about the HBSS/SELinux conflict and this was their reply:
>>
>> "SELinux is not compatible with HBSS...you can either use SELinux as
>> is and submit a waiver to Cybercom, disable the SE features and
>> install the required point product(s) (if possible), or migrate to a
>> different OS."
There are *so* many things wrong with that response you received.
s/SELinux is not compatible with HBSS/HBSS is not compatible with SELinux/r
Anyway.
>> When I contacted the HBSS office to find out how to get a waiver,
>> they told me that a waiver was not necessary and that there was a
>> "verbal understanding" between Cybercom and HBSS to give *nix systems
>> flexibility in their configuration until the HBSS/SELinux conflict is
>> resolved which is why Brain's system made it through IV&V.
FWIW, we (NSA + Red Hat) reached out to DISA FSO to get this sorted.
We'll see how things shake out, with aspirations for some type of
formally documented note in the STIG.
>> Granted, informal "understandings" within the DoD make me nervous but
>> that is where we are in right now. So what's the best way to
>> articulate this within a STIG? Beats me. I suggest the following
>> for group discussion:
>>
>> ============================
>> Group ID (Vulid): V-38667
>> Group Title: SRG-OS-000196
>> Rule ID: SV-50468r1_rule
>> Severity: CAT II
>> Rule Version (STIG-ID): RHEL-06-000285 Rule Title: The system must
>> have a host-based intrusion detection tool and/or a host-based
>> intrusion prevention tool installed.
>>
>> Vulnerability Discussion: Adding host-based intrusion detection tools
>> can provide the capability to automatically take actions in response
>> to malicious behavior, which can provide additional agility in
>> reacting to network threats. These tools also often include a
>> reporting capability to provide network awareness of the system,
>> which may not otherwise exist in an organization's systems management
>> regime. For DoD systems, the McAfee Host-based Security System
>> (HBSS) is provided to fulfill this role. Adding host-based intrusion
>> prevention tools increases system security by confining privileged
>> programs and user sessions. SELinux is provided to fulfill this
>> role. At this time, HBSS and SELinux are not compatible.
This is a good start, though to be fair, while SELinux plays a key role
in holistic host-based intrusion prevention, it is *not* particularly an
intrusion detection tool of itself. There's validity in keeping the two
(HIPS, HIDS) as separate requirements.
> <snip>
>
> What if the last 3 sentences were:
> Adding host-based intrusion prevention tools increases system security
> by confining privileged programs and user sessions. SELinux can be
> configured to fulfill the security prevention role. At this time,
> HBSS and SELinux are not compatible.
Perhaps a remapping of SSG rules back to CCIs could be used. The
language from the requirement:
> SRG-OS-000196
> 180.a. The system must have a host-based intrusion detection tool
> installed.
> <VulnDiscussion>Adding host-based intrusion detection tools can
> provide the capability to automatically take actions in response to
> malicious behavior, which can provide additional agility in reacting
> to network threats. These tools also often include a reporting
> capability to provide network awareness of system, which may not
> otherwise exist in an organization's systems management
> regime.</VulnDiscussion>
>
>
> Remediation instructions
> The base Red Hat platform already includes a sophisticated
> auditing system that can detect intruder activity, as well as
> SELinux, which provides host-based intrusion prevention
> capabilities by confining privileged programs and user
> sessions which may become compromised. Install an additional
> intrusion detection tool to provide complementary or
> duplicative monitoring, reporting, and reaction capabilities
> to those of the base platform. For DoD systems, the McAfee
> Host-based Security System is provided to fulfill this role.
>
The intent seems to be 'layered defense,' e.g. if native capabilities
break down within RHEL -- meaning someone corrupts not only the AIDE
database but further somehow mitigates SELinux -- the 3rd party software
(HBSS) will still hold integrity. This is laughable. If native
capabilities are mitigated, the box is *owned*.
Perhaps we could lobby FSO to alter this language to ensure that a HIDS
is installed, regardless of where it comes from.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130927/e5e1cfff/attachment.html>
More information about the scap-security-guide
mailing list