Cross-referencing CCE's and Remediation scripts

Spencer Shimko spencer at quarksecurity.com
Mon May 19 20:00:34 UTC 2014


On Mon, May 19, 2014 at 3:44 PM, Greg Elin <gregelin at gitmachines.com> wrote:
> I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
>
> It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
>
> Http://www.govready.org/cce/fixes/
>
> Would love feedback and thoughts in how to improve coverage.

Thanks Greg!  I was just writing an email inquiring about the status
of remediation in SSG when this hit my inbox.  Eerily coincidental.

To piggy back onto this thread a bit - I see postings with bits and
pieces of the content but I'm looking for a short summary of the
status, this is what we have, this is what is missing, this is what
we're looking for in the short-term.  And, based on Greg's, chart
above there are Aqueduct has remediation content missing from SSG and
SSG has remediation content missing from Aqueduct.  How is this gap
being closed?

In the meantime - how are people STIG'ing a box given the gap in
remediation content?

Thanks,
--Spencer

>
> Greg Elin
> P: 917-304-3488
> E:  gregelin at gitmachines.com
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



-- 
Spencer Shimko

Quark Security, Inc
quarksecurity.com
O: 443-457-8275 x1000
M: 858-877-3623


More information about the scap-security-guide mailing list