Re: Re: [PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED)

[Beavers, Randall D. CTR (US)]

Classification: UNCLASSIFIED
Caveats: NONE

Willy Santos & Shawn Wells,

I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists.
(searching CCI information online).

I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs
to DISA STIGS for my program.  Any help would be appreciated.  Seems the
DISA IASE website and the VMS site doesn't jive.

Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that
would help me? In excel format?  In xml format?

Please advise.

Randy Beavers, GSLC, CISSP
Information Assurance Engineer
Joint Battle Command-Platform
6000-C Technology Drive
Huntsville, AL 35805
256-842-5426 (work)
256-289-6054 (cell)
256-876-2576 (fax)
[e-mail]
[e-mail]

Classification: UNCLASSIFIED
Caveats: NONE

[PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED)

[Shawn Wells]

On 8/19/13 6:07 PM, Beavers, Randall D. CTR (US) wrote:
> Willy Santos & Shawn Wells,

Willy's no longer with RHT :(

He may still be lurking on the list though.
> I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists.
> (searching CCI information online).
>
> I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs
> to DISA STIGS for my program.  Any help would be appreciated.  Seems the
> DISA IASE website and the VMS site doesn't jive.
>
> Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that
> would help me? In excel format?  In xml format?
>
> Please advise.

Various rules are mapped back to policies via the <ref> tags. Example is 
the selinux_unlabeled_device_files rule:
> |<Rule id="selinux_unlabeled_device_files">
>
> <title>Ensure No Device Files are Unlabeled by SELinux</title>
> <description>Device files, which are used for communication with important
> system resources, should be labeled with proper SELinux types. If any device
> files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
> correct the file's context.
> </description>
> <ocil clause="there is output">To check for unlabeled device files, run the following command:
> <pre># ls -RZ /dev | grep unlabeled_t</pre>
> It should produce no output in a well-configured system.</ocil>
> <rationale>
> If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
> cannot properly restrict access to the device file.
> </rationale>
> <ident cce="26774-0" />
> <oval id="selinux_all_devicefiles_labeled" />
> <ref nist="AC-6,AU-9,CM-7" disa="22,32"/>
> <tested by="DS" on="20121024"/>
> </Rule>|

(ref: 
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/s...)

Through this metadata we can associate CCE 26774-0 against the indicated 
NIST 800-53 rev3 and DISA CCI requirements.

This information is transformed via the 'make tables' transform, which 
generates CCI to SRG:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-rhel6...

and CCI to NIST:
http://people.redhat.com/swells/scap-security-guide/RHEL6/output/table-stig-...

Do these help?

[PATCH 02/17] Mapped CCI-001436 to disable_vsftpd (UNCLASSIFIED)

[Jeffrey Blank]

Yes, I'd also be interested in the answer.
The policy mapping situation is messy.

It doesn't really seem like anybody makes consistent use (if not
utility) of 800-53.

Once the OVAL is tested with OpenSCAP, we will issue a security guide
from the project.  But at present it would be quite difficult to make
much sense of the policy mappings (aside from perhaps the CCIs issued in
the STIG) to include in any such issuance.

One of the original goals of the project was to ensure that a
high-quality set of mappings was available for the configuration
guidance, to simplify/speed the dissemination of this kind of
information and ease deployment.  Not so sure this is practical or
worthwhile anymore.

Consider this an invitation to open discussion on the matter.

___________________________
Jeffrey Blank
410-854-8675
Technology and Systems Analysis / Network Components
NSA Information Assurance

On 08/19/2013 06:07 PM, Beavers, Randall D. CTR (US) wrote:
> Classification: UNCLASSIFIED
> Caveats: NONE
>
> Willy Santos & Shawn Wells,
>
> I'm seeing you guys mapping a lot of CCIs to RHEL 6 on the lists.
> (searching CCI information online).
>
> I'm doing some work mapping the NIST 800-53 (v.4) to CCIs to DISA SRGs
> to DISA STIGS for my program.  Any help would be appreciated.  Seems the
> DISA IASE website and the VMS site doesn't jive.
>
> Do you guys have some definitive mappings for RHEL 6.4 CCEs / CCIs that
> would help me? In excel format?  In xml format?
>
> Please advise.
>
> Randy Beavers, GSLC, CISSP
> Information Assurance Engineer
> Joint Battle Command-Platform
> 6000-C Technology Drive
> Huntsville, AL 35805
> 256-842-5426 (work)
> 256-289-6054 (cell)
> 256-876-2576 (fax)
> [e-mail]
> [e-mail]
>
> Classification: UNCLASSIFIED
> Caveats: NONE
>
> scap-security-guide mailing list
> [e-mail]
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

--