why is testing for file integrity monitoring technology specific?

Trevor Vaughan tvaughan at onyxpoint.com
Wed Jul 29 00:50:03 UTC 2015


I'm guessing it's because it comes with RHEL and is therefore supported and
easy to test out of the box.

If your local Security Officer is willing to allow it, you could use pretty
much anything in place of AIDE.

Trevor

On Tue, Jul 28, 2015 at 6:50 PM, Bond Masuda <bond.masuda at hexadiam.com>
wrote:

>  I'm not sure if this is the place to talk about the specific content of
> the security standards or if the SSG is more "meta"...
>
> I see there is a test Rule ID: *package_aide_installed. *I am inclined to
> think that the spirit of this test is to have a file integrity monitoring
> (FIM) system. But why AIDE specifically? There are a few options for FIM,
> but not too many that one couldn't write tests to ensure that at least one
> of the handful of fully featured OSS FIM solutions is installed and
> configured. (other options that come to mind are OSSEC and Samhain)
> Additionally, AIDE development seems to be stagnant and perhaps not the
> best choice at this time.
>
> Where is this guidance coming from? Is the source of the guidance really
> technology specific or is the choice of AIDE just a specific interpretation
> of a more general guidance for a FIM solution? What's the rationale, if so?
>
> -Bond
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150728/e845f719/attachment.html>


More information about the scap-security-guide mailing list