SCAP FAQ Ideas?

leam hall leamhall at gmail.com
Wed Mar 25 15:58:36 UTC 2015


> On Wed, Mar 25, 2015 at 11:04 AM, Shawn Wells <shawn at redhat.com> wrote:

>> What other topics/questions should be covered? Feel free to edit the wiki
>> directly or reply to the list! This feedback will be driven into our
>> wikis/manuals, and formal docs off redhat.com.

Why are the Vulnerability IDs different for the issue across different STIGs?
 - Blame DISA

Where are the STIGs located?
 - iase.disa.mil

Is there a tool that correlates STIG Vuln IDs to CCE numbers, Nessus
plugins, or XYZ?
 - Dunno.

To answer questions 4 and 5, right now I'd say "The STIG is a basis
for measurement. The SCAP content contains some STIG material as well
as community best practice."

Leam

-- 
Mind on a Mission


More information about the scap-security-guide mailing list