On 8/20/13 10:51 AM, Robert Sanders wrote:
I had gotten a request from a customer to provide a mapping of what STIG
line items were covered by Security Blanket. I didn't know initially if my
customer meant the officially approved STIG that DISA posted or the SSG
content. The official STIG has the identifiers (such as RHEL-06-000001) in the
actual line item code within the xccdf document. The SSG content does not, and
I was speculating that the references (x.y.z) in the prose/reports were
programmatically generated from the xccdf.
I should note, that having the references either in-line or available in a
direct mapping makes life much easier for those of us who read the contents of
the files but are doing so somewhat outside the scap/oscap world. Granted, the
content is in a defined format which an associated spec, and should be read in
said fashion.
Turns out I only need to address the official STIG document for now, but
this raised the questions of how the SSG line items would be mapped back to the
STIG line items, including the concerns on how the issues of 'new entries' and
'deprecated/retired entries' would be handled to produce a consistent numbering.
Existing maps are to the CCIs. Do they want the RHEL-06-****** number
for some reason?
Stupid question of the day as well since I'm on the topic of numbering. Is
the SSG content directly consumable by other SCAP scanners? I realize this may
be a somewhat loaded question with a convoluted answer (SCAP version number,
OVAL version numbers, OCIL .......)
Should be compatible with any SCAP compliant scanner. We've worked with
the Tenable/ACAS folk in the past, and the SPAWAR SCC guys have tested
as well.
_______________________________________________
scap-security-guide mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
