Thanks Jeff. I concur wholeheartedly with not using the x.y.z references. I haven't seen a overlay for DISA STIG <-> SSG Rule maping, is this internal to DISA or buried somewhere in the SSG?
-Rob ________________________________________ From: [email protected] [[email protected]] on behalf of Jeffrey Blank [[email protected]] Sent: Monday, August 19, 2013 5:50 PM To: [email protected] Subject: Re: SSG line item references The Rule id (the id attribute) in SSG is your best bet for a stable identifier. This is what Profiles use to reference Rules, too. The x.y.z-style section numbers may change at any time and they should not be used as references. I will shortly be posting a table that shows the ID in human readable form. The STIG "overlay" should provide linkage between the issued DISA IDs (randomly assigned numbers), but I do not know if this is accurate at present. Maintaining transparent, reproducible linkage between the SSG upstream and the issued STIG remains a goal. It may be worth revisiting, with DISA, the idea of the STIG as a Profile in SSG instead of this overlay construct. On 08/19/2013 10:59 AM, Robert Sanders wrote: > Quick question - I'm looking at the SSG content files and trying to > determine the 'line item' number for a particular check. The DISA STIG > content is layed out so that the line item information (i.e., > rhel-06-0000001) is inline with a particular check. The SSG content > doesn't appear to have this inline, and I suspect that the line items > are being generated programmatically via the oscap command but I haven't > drilled down to see what oscap is actually doing. Considering that the > SSG is the upstream document for the RHEL6 STIG - is DISA responsible > for remapping the SSG items to the STIG items, or will DISA adopt the > way that the SSG is generating line items? If the latter, could this > result in line item x.z.y from version A be a *very* different best than > line item x.y.z from version B? > > -Rob > > > > _______________________________________________ > scap-security-guide mailing list > [email protected] > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide _______________________________________________ scap-security-guide mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
