Insight into release timing of RHEL7 STIG as "official" -- any help needed on the Project?
Šimon Lukašík
isimluk at fedoraproject.org
Wed Sep 30 17:01:37 UTC 2015
On 09/29/2015 05:49 PM, Jeffrey Hawkins wrote:
> Anyone have any insight on when the RHEL7 STIG is going to be ready for
> prime time to be picked up by DISA? I work for a company the delivers
> RHEL based Products that use the STIG as part of the Security Standards
> /Benchmark to follow, and right now we are middle of development cycle
> of migrating our Products from RHEL6 to RHEL7. We are leveraging
> existing RHEL6 STIG, and the early RHEL7 drafts where it make sense
> within our own Hardening Framework (developed and carried forward from
> pre-RHEL4 days). We would like to avoid what we faced with RHEL6 with
> chasing the Draft verses RHEL5 STIG, and speculating what would be in
> the final . So, thought I would raise a query of the Benchmark rollout...
>
>
> Are there areas where help is needed as I/we would be more than happy to
> help the Project?
>
Hello Jeff,
It is work in progress. All the development is taking place in
https://github.com/OpenSCAP/scap-security-guide/tree/master/RHEL/7
So far, the focus was on PCI-DSS. We understood PCI-DSS as a sub-set of
STIG (not precise, but close). PCI-DSS is close to be finished. So, the
focus will shift towards STIG upstream work.
We are more then welcome to any contribution!
Thanks!
--
Šimon Lukašík
Senior Software Engineer
Team Lead, Security Compliance, Red Hat, Inc.
More information about the scap-security-guide
mailing list