<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 4/14/14, 2:26 PM, Shawn Wells wrote:<br>
</div>
<blockquote cite="mid:534C2871.5090801@redhat.com" type="cite">On
4/14/14, 2:23 PM, Jeffrey Blank wrote:
<br>
<blockquote type="cite" style="color: #000000;">NACK to all
(except typos), but let's discuss in person tomorrow
<br>
morning at Summit.
<br>
<br>
Many of these were removed or are not in RHEL 6 to begin with.
Or are
<br>
handled in other ways. I'd like to have a discussion with the
driver
<br>
for this Profile, since I believe its intentions are already
achieved
<br>
through existing Rules.
<br>
</blockquote>
<br>
Please elaborate on this.
<br>
<br>
You seem to be nack'ing on your personal perspective that CIA's
Linux baseline doesn't match your view on what a baseline should
be.
<br>
</blockquote>
<br>
<br>
SSG represents a body of controls through which interested parties
can form their own profiles. A significant part of SSG's value is
that profile owners need not agree on security controls: by
definition the DoD baseline (e.g. the STIG) can be different from Ft
Meade's baseline (e.g. CS2), which is further different than CIA's
(via C2S). The C2S patches do not alter any existing baselines, so
the basis of your objection is unclear.<br>
<br>
There's certainly value to working with profile owners to evolve
their underlying requirements, however that reflects <i><b>future</b></i>
initiatives. The submitted C2S profile reflects requirements as they
are today. I agree many of their requirements are... interesting...
as reflected in the <rationale> tag here:<br>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005233.html">https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005233.html</a><br>
<br>
With that said, the C2S baseline is the current U.S. Government
mandated security control list for all Linux instances within the
Commercial Cloud. CIA established the C2s baseline requirements long
ago (1yr+?) through a formal RFP which was awarded earlier this
year. These are C2S's requirements, period. Lack of the C2S profile
will alienate tenants of C2S, which is most of the U.S. Intelligence
Community, and make SSG irrelevant to them.<br>
<br>
<br>
</body>
</html>