[PATCH 3/3] updated 800-53 control references (system)

Shawn Wells shawn at redhat.com
Fri Jul 18 00:44:46 UTC 2014


On 7/18/14, 4:21 AM, David Smith wrote:
> Signed-off-by: David Smith <dsmith at secure-innovations.net>
> ---
>   RHEL/6/input/system/auditing.xml           |   58 ++++++++++++++--------------
>   RHEL/6/input/system/network/ipsec.xml      |    2 +-
>   RHEL/6/input/system/network/kernel.xml     |    2 +-
>   RHEL/6/input/system/network/wireless.xml   |    8 ++--
>   RHEL/6/input/system/software/integrity.xml |   12 +++---
>   5 files changed, 41 insertions(+), 41 deletions(-)
>
> diff --git a/RHEL/6/input/system/auditing.xml b/RHEL/6/input/system/auditing.xml
> index 70ad93a..e25f890 100644
> --- a/RHEL/6/input/system/auditing.xml
> +++ b/RHEL/6/input/system/auditing.xml
> @@ -510,7 +510,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
>   to the system time should be audited.</rationale>
>   <ident cce="26242-8" />
>   <oval id="audit_rules_time_adjtimex" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   <ref disa="1487,169" />
>   </Rule>
>   
> @@ -538,7 +538,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
>   to the system time should be audited.</rationale>
>   <ident cce="27203-9" />
>   <oval id="audit_rules_time_settimeofday" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   <ref disa="1487,169" />
>   </Rule>
>   
> @@ -564,7 +564,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
>   to the system time should be audited.</rationale>
>   <ident cce="27169-2" />
>   <oval id="audit_rules_time_stime" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   <ref disa="1487,169" />
>   </Rule>
>   
> @@ -592,7 +592,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
>   to the system time should be audited.</rationale>
>   <ident cce="27170-0" />
>   <oval id="audit_rules_time_clock_settime" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   <ref disa="1487,169" />
>   </Rule>
>   
> @@ -617,7 +617,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes
>   to the system time should be audited.</rationale>
>   <ident cce="27172-6" />
>   <oval id="audit_rules_time_watch_localtime" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   <ref disa="1487,169" />
>   </Rule>
>   </Group><!--End <Group id="audit_time_rules"> -->
> @@ -646,7 +646,7 @@ unexpected users, groups, or modifications should be investigated for
>   legitimacy.</rationale>
>   <ident cce="26664-3" />
>   <oval id="audit_rules_usergroup_modification" />
> -<ref nist="AC-2(4),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
> +<ref nist="AC-2(4),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="18,1403,1404,1405,1684,1683,1685,1686"/>
>   </Rule>
>   
>   <Rule id="audit_network_modifications">
> @@ -672,7 +672,7 @@ than administrator action. Any change to network parameters should be
>   audited.</rationale>
>   <ident cce="26648-6" />
>   <oval id="audit_rules_networkconfig_modification" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   </Rule>
>   
>   <Rule id="file_permissions_var_log_audit">
> @@ -729,7 +729,7 @@ arbitrarily changed by anything other than administrator action. All changes to
>   MAC policy should be audited.</rationale>
>   <ident cce="26657-7" />
>   <oval id="audit_rules_mac_modification" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   </Rule>
>   
>   <Group id="audit_dac_actions">
> @@ -779,7 +779,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="26280-8" />
>   <oval id="audit_rules_dac_modification_chmod" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_chown">
> @@ -805,7 +805,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27173-4" />
>   <oval id="audit_rules_dac_modification_chown" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fchmod">
> @@ -831,7 +831,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27174-2" />
>   <oval id="audit_rules_dac_modification_fchmod" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fchmodat">
> @@ -857,7 +857,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27175-9" />
>   <oval id="audit_rules_dac_modification_fchmodat" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fchown">
> @@ -883,7 +883,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27177-5" />
>   <oval id="audit_rules_dac_modification_fchown" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fchownat">
> @@ -909,7 +909,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27178-3" />
>   <oval id="audit_rules_dac_modification_fchownat" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fremovexattr">
> @@ -935,7 +935,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27179-1" />
>   <oval id="audit_rules_dac_modification_fremovexattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_fsetxattr">
> @@ -961,7 +961,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27180-9" />
>   <oval id="audit_rules_dac_modification_fsetxattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_lchown">
> @@ -987,7 +987,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27181-7" />
>   <oval id="audit_rules_dac_modification_lchown" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_lremovexattr">
> @@ -1013,7 +1013,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27182-5" />
>   <oval id="audit_rules_dac_modification_lremovexattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_lsetxattr">
> @@ -1039,7 +1039,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27183-3" />
>   <oval id="audit_rules_dac_modification_lsetxattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_removexattr">
> @@ -1065,7 +1065,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27184-1" />
>   <oval id="audit_rules_dac_modification_removexattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_rules_dac_modification_setxattr">
> @@ -1091,7 +1091,7 @@ calls with others as identifying earlier in this guide is more efficient.
>   </warning>
>   <ident cce="27185-8" />
>   <oval id="audit_rules_dac_modification_setxattr" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   </Group> <!-- <Group id="audit_dac_actions"> -->
> @@ -1108,7 +1108,7 @@ files involved in storing logon events, add the following to <tt>/etc/audit/audi
>   as an attacker attempting to remove evidence of an intrusion.</rationale>
>   <ident cce="26691-6" />
>   <oval id="audit_rules_login_events" />
> -<ref nist="AC-17(7),AU-1(b),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),IR-5" />
>   </Rule>
>   
>   <Rule id="audit_manual_session_edits">
> @@ -1125,7 +1125,7 @@ storing such process information, add the following to
>   as an attacker attempting to remove evidence of an intrusion.</rationale>
>   <ident cce="26610-6" />
>   <oval id="audit_rules_session_events" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" />
>   </Rule>
>   
>   <Rule id="audit_rules_unsuccessful_file_modification">
> @@ -1146,7 +1146,7 @@ To verify that the audit system collects unauthorized file accesses, run the fol
>   these events could serve as evidence of potential system compromise.</rationale>
>   <ident cce="26712-0" />
>   <oval id="audit_rules_unsuccessful_file_modification" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" />
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126" />
>   </Rule>
>   
>   <Rule id="audit_privileged_commands">
> @@ -1174,7 +1174,7 @@ unusual activity.
>   </rationale>
>   <ident cce="26457-2" />
>   <oval id="audit_rules_privileged_commands" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-2(4),IR-5" disa="40" />
> +<ref nist="AC-3(10)),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AC-6(9),IR-5" disa="40" />
>   <tested by="JL" on="20140703"/>
>   </Rule>
>   
> @@ -1196,7 +1196,7 @@ trail should be created each time a filesystem is mounted to help identify and g
>   loss.</rationale>
>   <ident cce="26573-6" />
>   <oval id="audit_rules_media_export" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   <tested by="DS" on="20121024"/>
>   </Rule>
>   
> @@ -1217,7 +1217,7 @@ from the system. The audit trail could aid in system troubleshooting, as well as
>   malicious processes that attempt to delete log files to conceal their presence.</rationale>
>   <ident cce="26651-0" />
>   <oval id="audit_rules_file_deletion_events" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_sysadmin_actions">
> @@ -1235,7 +1235,7 @@ To verify that auditing is configured for system administrator actions, run the
>   of what was executed on the system, as well as, for accountability purposes.</rationale>
>   <ident cce="26662-7" />
>   <oval id="audit_rules_sysadmin_actions" />
> -<ref nist="AC-2(7)(b),AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-2(7)(b),AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   <tested by="DS" on="20121024"/>
>   </Rule>
>   
> @@ -1257,7 +1257,7 @@ the kernel and potentially introduce malicious code into kernel space. It is imp
>   to have an audit trail of modules that have been introduced into the kernel.</rationale>
>   <ident cce="26611-4" />
>   <oval id="audit_rules_kernel_module_loading" />
> -<ref nist="AC-17(7),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
> +<ref nist="AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),IR-5" disa="126"/>
>   </Rule>
>   
>   <Rule id="audit_config_immutable">
> diff --git a/RHEL/6/input/system/network/ipsec.xml b/RHEL/6/input/system/network/ipsec.xml
> index 0c64e74..97c9f72 100644
> --- a/RHEL/6/input/system/network/ipsec.xml
> +++ b/RHEL/6/input/system/network/ipsec.xml
> @@ -19,7 +19,7 @@ transmitted over a wide area network.
>   </rationale>
>   <ident cce="27626-1" />
>   <oval id="package_openswan_installed" />
> -<ref nist="AC-17, MA-4, SC-9" disa="1130,1131" />
> +<ref nist="AC-17, MA-4, SC-8" disa="1130,1131" />
>   </Rule>
>   </Group>
>   
> diff --git a/RHEL/6/input/system/network/kernel.xml b/RHEL/6/input/system/network/kernel.xml
> index 5dd0275..05756be 100644
> --- a/RHEL/6/input/system/network/kernel.xml
> +++ b/RHEL/6/input/system/network/kernel.xml
> @@ -262,7 +262,7 @@ sign of nefarious network activity. Logging these packets enables this activity
>   to be detected.</rationale>
>   <ident cce="27066-0" />
>   <oval id="sysctl_net_ipv4_conf_all_log_martians" value="sysctl_net_ipv4_conf_all_log_martians_value" />
> -<ref nist="AC-17(7),CM-7" disa="126"/>
> +<ref nist="AC-3(10),CM-7" disa="126"/>
>   <tested by="DS" on="20121024"/>
>   </Rule>
>   
> diff --git a/RHEL/6/input/system/network/wireless.xml b/RHEL/6/input/system/network/wireless.xml
> index 703f8dd..30ea982 100644
> --- a/RHEL/6/input/system/network/wireless.xml
> +++ b/RHEL/6/input/system/network/wireless.xml
> @@ -35,7 +35,7 @@ to reboot the system first.
>   </rationale>
>   <ident cce="26878-9" />
>   <!--TODO:OCIL <oval id="wireless_disable_in_bios" />-->
> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
>   </Rule>
>   
>   <Rule id="deactivate_wireless_interfaces">
> @@ -65,7 +65,7 @@ protocols which were not designed with security in mind.
>   </rationale>
>   <ident cce="27057-9" />
>   <oval id="wireless_disable_interfaces" />
> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85" />
>   <tested by="DS" on="20121025"/>
>   </Rule>
>   
> @@ -84,7 +84,7 @@ Nevertheless, variation in this risk decision may be expected due to the
>   utility of Bluetooth connectivity and its limited range.</rationale>
>   <ident cce="27081-9" />
>   <oval id="service_bluetooth_disabled" />
> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" />
> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" />
>   <tested by="DS" on="20121025"/>
>   </Rule>
>   
> @@ -106,7 +106,7 @@ from loading the kernel module provides an additional safeguard against its
>   activation.</rationale>
>   <ident cce="26763-3" />
>   <oval id="kernel_module_bluetooth_disabled" />
> -<ref nist="AC-17(8),AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" />
> +<ref nist="AC-18(a),AC-18(d),AC-18(3),CM-7" disa="85,1551" />
>   <tested by="DS" on="20121025"/>
>   </Rule>
>   
> diff --git a/RHEL/6/input/system/software/integrity.xml b/RHEL/6/input/system/software/integrity.xml
> index 55bf115..943140d 100644
> --- a/RHEL/6/input/system/software/integrity.xml
> +++ b/RHEL/6/input/system/software/integrity.xml
> @@ -41,7 +41,7 @@ The AIDE package must be installed if it is to be available for integrity checki
>   </rationale>
>   <ident cce="27024-9" />
>   <oval id="package_aide_installed" />
> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28, SI-7" disa="1069"/>
> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28, SI-7" disa="1069"/>
>   <tested by="DS" on="20121024"/>
>   </Rule>
>   
> @@ -61,7 +61,7 @@ of AIDE, because it changes binaries.
>   </rationale>
>   <ident cce="27221-1" />
>   <oval id="disable_prelink" />
> -<ref nist="CM-6(d),CM-6(3),SC-28, SI-7" />
> +<ref nist="CM-6(d),SC-28, SI-7" />
>   </Rule>
>   
>   <Rule id="aide_build_database">
> @@ -82,7 +82,7 @@ For AIDE to be effective, an initial database of "known-good" information about
>   must be captured and it should be able to be verified against the installed files.
>   </rationale>
>   <ident cce="27135-3" />
> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" />
> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" />
>   </Rule>
>   
>   <Rule id="aide_periodic_cron_checking" severity="medium">
> @@ -101,7 +101,7 @@ By default, AIDE does not install itself for periodic execution. Periodically
>   running AIDE is necessary to reveal unexpected changes in installed files.
>   </rationale>
>   <ident cce="27222-9" />
> -<ref nist="CM-3(d),CM-3(e),CM-6(d),CM-6(3),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/>
> +<ref nist="CM-3(d),CM-3(e),CM-6(d),SC-28,SI-7" disa="374,416,1069,1263,1297,1589"/>
>   </Rule>
>   </Group>
>   
> @@ -142,7 +142,7 @@ The permissions set by the vendor should be maintained. Any deviations from
>   this baseline should be investigated.</rationale>
>   <ident cce="26731-0" />
>   <oval id="rpm_verify_permissions" />
> -<ref nist="AC-6,CM-6(d),CM-6(3)" disa="1493,1494,1495" />
> +<ref nist="AC-6,CM-6(d),SI-7" disa="1493,1494,1495" />
>   </Rule>
>   
>   <Rule id="rpm_verify_hashes">
> @@ -173,7 +173,7 @@ information given by the RPM database. Executables with erroneous hashes could
>   be a sign of nefarious activity on the system.</rationale>
>   <ident cce="27223-7" />
>   <oval id="rpm_verify_hashes" />
> -<ref nist="CM-6(d),CM-6(3),SI-7" disa="1496" />
> +<ref nist="CM-6(d),SI-7" disa="1496" />
>   </Rule>
>   
>   </Group>

ack



More information about the scap-security-guide mailing list