who uses CCE ids for RHEL guidance?

[Jeffrey Blank]

A question for the list:

Who uses CCE identifiers (and for what)?

I find them (informally) useful since they provide a unique identifier
for a particular knob.  Of course, internal to the project, the XCCDF
Rule id fulfills a similar role, though we'll have both.

(I also have some reservations about CCE implementation and format, but
those are not related to this inquiry, nor am I soliciting for those!)

I'm simply curious about uses of CCE in RHEL security guidance,
particularly that which would be derived from the project.

Thanks!

[Shawn Wells]

On 3/17/13 1:41 PM, Jeffrey Blank wrote:
> A question for the list:
>
> Who uses CCE identifiers (and for what)?
>
> I find them (informally) useful since they provide a unique identifier
> for a particular knob.  Of course, internal to the project, the XCCDF
> Rule id fulfills a similar role, though we'll have both.
>
> (I also have some reservations about CCE implementation and format, but
> those are not related to this inquiry, nor am I soliciting for those!)
>
> I'm simply curious about uses of CCE in RHEL security guidance,
> particularly that which would be derived from the project.

Personally I never use them, or even talk about them. When going through 
compliance processes I've found C&A stakeholders want to know about 
/their/ requirement, e.g. OS SRG or NIST 800-53 reference.

[Nunez, Luis K]

I’ve see CCEs being incorporated into the DISA STIGs and USGCB XCCDF content.  CCEs could be used to map to other regulatory regimes.
Following is a conceptually mapping of high level regulations to granular technical settings.

Regulatory – FISMA, HIPAA, NERC etc…
Controls – NIST 800-53, HITEC, CIP
DISA SRG/STIG – Mapping to Controls (CCI) in this case to NIST 800-53 rev.3.
CCE- Granular platform specific configuration.

SCAP repository contains CCE mappings to various content.
http://scaprepo.com

Red Hat CCE for REL5 “/etc/group file…”
http://www.scaprepo.com/view.jsp?id=CCE-3276-3  we can see that this setting impacts various controls for differing regulatory verticals.

NIST now maintains CCE at:
http://nvd.nist.gov/cce/
CCE mappings to NIST 800-53
http://nvd.nist.gov/cce.cfm

In the end CCEs could be used to attest assertions to compliance in a referenceable manner for C&A activities.

-ln

From: [e-mail] [mailto:[e-mail]] On Behalf Of Shawn Wells
Sent: Sunday, March 24, 2013 11:29 PM
To: [e-mail]
Subject: Re: who uses CCE ids for RHEL guidance?

On 3/17/13 1:41 PM, Jeffrey Blank wrote:

A question for the list:

Who uses CCE identifiers (and for what)?

I find them (informally) useful since they provide a unique identifier

for a particular knob.  Of course, internal to the project, the XCCDF

Rule id fulfills a similar role, though we'll have both.

(I also have some reservations about CCE implementation and format, but

those are not related to this inquiry, nor am I soliciting for those!)

I'm simply curious about uses of CCE in RHEL security guidance,

particularly that which would be derived from the project.

Personally I never use them, or even talk about them. When going through compliance processes I've found C&A stakeholders want to know about their requirement, e.g. OS SRG or NIST 800-53 reference.