<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 6/4/13 1:43 PM, Nunez, Luis K wrote:<br>
</div>
<blockquote
cite="mid:FDCC719E8EC4714EBFDE8473009EF6EC02F92FC1@IMCMBX03.MITRE.ORG"
type="cite">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Another
way to look at the remediation strategy is to have an
independent source for building fix content. The source would
provide basic information needed to change a system to a
secure state. This information would reside alongside the
check information in the XCCDF policy. Having a common source
will help in achieving consistency in remedial actions
performed by differing scripting languages or fix systems .<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This
method could also be used as a way to check parity in the
checking and fixing content for correctness. <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This
is probably a good time to review Common Remediation
Enumeration and see if fits into the project objective. CRE
was created to identify and provide a reference point for
actions necessary to correct a security issue. Based on the
CRE-ID one could build remediation scripts and systems in a
referenced way. The CRE-ID could also be used for
traceability in troubleshooting and change control management.
</span></p>
</blockquote>
<br>
Reviewed the examples @
<a class="moz-txt-link-freetext" href="http://scap.nist.gov/specifications/cre/1.0/cre_examples.xml">http://scap.nist.gov/specifications/cre/1.0/cre_examples.xml</a><br>
<br>
And then the spec @
<a class="moz-txt-link-freetext" href="http://scap.nist.gov/specifications/cre/1.0/cre_1.0-draft.xsd">http://scap.nist.gov/specifications/cre/1.0/cre_1.0-draft.xsd</a><br>
<br>
Seems like this would be a major schema change, requiring updates to
every rule, but I don't particularly see the value. Maybe it's just
me being dense =/<br>
<br>
Seems like an interesting approach to have XCCDF express
"requirements," OVAL to check system state, <fix> tags for
automated compliance, then CRE for manual remediation. From what I
gather, the CRE really is a different way to express SSG's usage of
OCIL tags. Can you help explain what value would be gained by
changing content to CRE?
</body>
</html>