[PATCH 00/15] Adding new profile, C2S
Shawn Wells
shawn at redhat.com
Mon Apr 14 18:47:45 UTC 2014
On 4/14/14, 2:26 PM, Shawn Wells wrote:
> On 4/14/14, 2:23 PM, Jeffrey Blank wrote:
>> NACK to all (except typos), but let's discuss in person tomorrow
>> morning at Summit.
>>
>> Many of these were removed or are not in RHEL 6 to begin with. Or are
>> handled in other ways. I'd like to have a discussion with the driver
>> for this Profile, since I believe its intentions are already achieved
>> through existing Rules.
>
> Please elaborate on this.
>
> You seem to be nack'ing on your personal perspective that CIA's Linux
> baseline doesn't match your view on what a baseline should be.
SSG represents a body of controls through which interested parties can
form their own profiles. A significant part of SSG's value is that
profile owners need not agree on security controls: by definition the
DoD baseline (e.g. the STIG) can be different from Ft Meade's baseline
(e.g. CS2), which is further different than CIA's (via C2S). The C2S
patches do not alter any existing baselines, so the basis of your
objection is unclear.
There's certainly value to working with profile owners to evolve their
underlying requirements, however that reflects /*future*/ initiatives.
The submitted C2S profile reflects requirements as they are today. I
agree many of their requirements are... interesting... as reflected in
the <rationale> tag here:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005233.html
With that said, the C2S baseline is the current U.S. Government mandated
security control list for all Linux instances within the Commercial
Cloud. CIA established the C2s baseline requirements long ago (1yr+?)
through a formal RFP which was awarded earlier this year. These are
C2S's requirements, period. Lack of the C2S profile will alienate
tenants of C2S, which is most of the U.S. Intelligence Community, and
make SSG irrelevant to them.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140414/394fd265/attachment.html>
More information about the scap-security-guide
mailing list