[PATCH 00/15] Adding new profile, C2S

Shawn Wells shawn at redhat.com
Mon Apr 14 18:47:45 UTC 2014


On 4/14/14, 2:26 PM, Shawn Wells wrote:
> On 4/14/14, 2:23 PM, Jeffrey Blank wrote:
>> NACK to all (except typos), but let's discuss in person tomorrow
>> morning at Summit.
>>
>> Many of these were removed or are not in RHEL 6 to begin with. Or are
>> handled in other ways.  I'd like to have a discussion with the driver
>> for this Profile, since I believe its intentions are already achieved
>> through existing Rules.
>
> Please elaborate on this.
>
> You seem to be nack'ing on your personal perspective that CIA's Linux 
> baseline doesn't match your view on what a baseline should be.


SSG represents a body of controls through which interested parties can 
form their own profiles. A significant part of SSG's value is that 
profile owners need not agree on security controls: by definition the 
DoD baseline (e.g. the STIG) can be different from Ft Meade's baseline 
(e.g. CS2), which is further different than CIA's (via C2S). The C2S 
patches do not alter any existing baselines, so the basis of your 
objection is unclear.

There's certainly value to working with profile owners to evolve their 
underlying requirements, however that reflects /*future*/ initiatives. 
The submitted C2S profile reflects requirements as they are today. I 
agree many of their requirements are... interesting... as reflected in 
the <rationale> tag here:
https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005233.html

With that said, the C2S baseline is the current U.S. Government mandated 
security control list for all Linux instances within the Commercial 
Cloud. CIA established the C2s baseline requirements long ago (1yr+?) 
through a formal RFP which was awarded earlier this year. These are 
C2S's requirements, period. Lack of the C2S profile will alienate 
tenants of C2S, which is most of the U.S. Intelligence Community, and 
make SSG irrelevant to them.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140414/394fd265/attachment.html>


More information about the scap-security-guide mailing list