SSG for RHEL 6 (UNCLASSIFIED)

Burns, Robert K (US SSA) robert.burns at baesystems.com
Wed Feb 26 16:54:03 UTC 2014


Chris,

The below, sent to me by a colleague of mine, seems to address your question:

Per the guidance from NIST National Vulnerability Database (NVD) website 
(http://web.nvd.nist.gov/view/ncp/repository/glossary?cid=1#Authority) we are 
allowed to use Vendor produced SCAP content in the absence of "Governmental 
Authority" checklists. The link above will take you to the source, but I 
copied & pasted the verbiage below:

Authority

The organization responsible for producing the original security configuration 
guidance represented by the checklist. Authorities are ranked according to 
their "Authority Type." Within the NCP website authorities are grouped with 
their authority types through the syntax of Authority Type: Authority.

If it is not clear which checklists(s) should be analyzed, users from Federal 
civilian agencies should first search for checklists produced by authorities 
of type "Governmental Authority." If "Governmental Authority" produced 
checklists exist the user should first search for NIST-produced checklists, 
which are tailored for civilian agency use. If no NIST-produced checklist is 
available, then agency-produced checklists from the Defense Information 
Systems Agency (DISA) or the National Security Agency (NSA) should be used. If 
no "Governmental Authority" checklists exist the user should search for 
checklists produced by authorities of type "Software Vendor." If none of these 
checklists exist the user should search for checklists produced by authorities 
of type "Third Party."

Authority Type

Type of organization that lends its authority to the checklist. The three 
types are Governmental Authority, Software Vendor, and Third Party (e.g., 
security organizations).

Regards,

Robert

-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org 
[mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of 
Bailey, Christopher D CTR USARMY AMRDEC (US)
Sent: Tuesday, February 25, 2014 12:45 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: SSG for RHEL 6 (UNCLASSIFIED)

Classification: UNCLASSIFIED
Caveats: NONE

Does anyone know if there's been an official approval from DISA for the use of 
SSG content and the openSCAP utility on RHEL 6 systems for providing official 
vulnerability reports to IA inspectors?  Our local IA folks tell us that SCC 
is the only DISA approved/provided product that we can use for scanning our 
systems and providing scan results to IA for inspection and analysis. 
However, SCC only provides content up to RHEL 5, which is of no help with RHEL 
6.  We have our own homemade script for scanning, but that's only good for 
in-house use. We need something for producing official SCAP formatted 
vulnerability reports. We believe our best option for automated scanning is 
the openSCAP tool with SSG content, which is what we want to use, but there 
doesn't seem to be any official acceptance for its use.

Basically, my IA folks want to see something in writing from DISA that says 
they officially approve the use of SSG content and the openSCAP tool for 
proving IA compliance on RHEL 6 systems.  I know that the DISA FSO is working 
closely with Red Hat on SSG, but I can't find anything like an official 
release from DISA.

Thanks.


Classification: UNCLASSIFIED
Caveats: NONE


_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 9994 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140226/e8dd29f7/attachment.p7s>


More information about the scap-security-guide mailing list