why is testing for file integrity monitoring technology specific?

Bond Masuda bond.masuda at hexadiam.com
Thu Jul 30 21:57:41 UTC 2015


Ok. I guess I will need to learn how to write OVAL and XCCDF content....

Besides that, my coworker and I just noticed that although we fail the
AIDE test, we are passing the aide_periodic_cron_checking test. This
might be a bug??? Can anyone replicate?

-Bond

On 07/28/2015 05:59 PM, Shawn Wells wrote:
> Exactly.
>
> Oval content to extend to other tools would be most welcome!
>
> -- 
> Shawn Wells
> Director, Innovation Programs
> shawn at redhat.com <mailto:shawn at redhat.com> | 443.534.0130
> @shawndwells
>
> On Jul 28, 2015, at 7:50 PM, Trevor Vaughan <tvaughan at onyxpoint.com
> <mailto:tvaughan at onyxpoint.com>> wrote:
>
>> I'm guessing it's because it comes with RHEL and is therefore
>> supported and easy to test out of the box.
>>
>> If your local Security Officer is willing to allow it, you could use
>> pretty much anything in place of AIDE.
>>
>> Trevor
>>
>> On Tue, Jul 28, 2015 at 6:50 PM, Bond Masuda
>> <bond.masuda at hexadiam.com <mailto:bond.masuda at hexadiam.com>> wrote:
>>
>>     I'm not sure if this is the place to talk about the specific
>>     content of the security standards or if the SSG is more "meta"...
>>
>>     I see there is a test Rule ID: *package_aide_installed. *I am
>>     inclined to think that the spirit of this test is to have a file
>>     integrity monitoring (FIM) system. But why AIDE specifically?
>>     There are a few options for FIM, but not too many that one
>>     couldn't write tests to ensure that at least one of the handful
>>     of fully featured OSS FIM solutions is installed and configured.
>>     (other options that come to mind are OSSEC and Samhain)
>>     Additionally, AIDE development seems to be stagnant and perhaps
>>     not the best choice at this time.
>>
>>     Where is this guidance coming from? Is the source of the guidance
>>     really technology specific or is the choice of AIDE just a
>>     specific interpretation of a more general guidance for a FIM
>>     solution? What's the rationale, if so?
>>
>>     -Bond
>>
>>     --
>>     SCAP Security Guide mailing list
>>     scap-security-guide at lists.fedorahosted.org
>>     <mailto:scap-security-guide at lists.fedorahosted.org>
>>     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>     https://github.com/OpenSCAP/scap-security-guide/
>>
>>
>>
>>
>> -- 
>> Trevor Vaughan
>> Vice President, Onyx Point, Inc
>> (410) 541-6699
>>
>> -- This account not approved for unencrypted proprietary information --
>> -- 
>> SCAP Security Guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> <mailto:scap-security-guide at lists.fedorahosted.org>
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>> https://github.com/OpenSCAP/scap-security-guide/
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150730/1c3d3ed4/attachment-0001.html>


More information about the scap-security-guide mailing list