[Open-scap] Making Fix Templates

Sat Jan 12 03:43:45 UTC 2019

It's the other way around. Most DOD Information Assurance departments use
the DISA IASE stuff that are based off of a Vulnerability ID (VID). The
VIDs are normally associated with a CCI or CCE; sometimes both or one or
the other. The VIDs are sometimes the results of the Information Assurance
Vulnerability Management (IAVM) creating Information Assurance
Vulnerability Alerts (IAVA). An example is IAVM gets aware of the Meltdown
vulnerability so they create an IAVA to notify people to do "temporary"
mitigation. Later a VID is stated to use a kernel version that not
vulnerable to the Meltdown vulnerability.

VID, IAVA, IAVM are DoD terms whereas CCI and CCE are industry standard
terms. IMO is the DOD doing the "Security through obscurity" method to
confuse everyone. LOL. That's also where oscap used to need the
--stig-viewer option for DOD to use it with the "Approved" STIG Viewer. And
I believe XCCDF 1.2 kind of help to address some of those issues to
standardize the XML reports. Pretty much every where I've seen outside of
DOD use CCI and CCE as identifiers, not VID.

That being said... You could ask most DOD Information Assurance folks to
explain what a CCI or CCE is and they'd be lost. Ask them what a VID is and
they'll recite the official documented definition of what it is and how
it's handled. Let's not even get started on CVEs.

------------------------------
Thank you for your time,

Boyd H. Ako

boyd.hanalei.ako at gmail.com
https://www.boydhanaleiako.me
Cell Phone: (424) 244-9653PGP/GPG Public Key:
https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
------------------------------

On Fri, Jan 11, 2019 at 4:07 PM Ruben Oliva <david.oliva at verizon.net> wrote:

> Hello folks.  Here's my two cents.
>
> The CCI is not an SCAP specification but a DISA one.  In my observations,
> it appears that Red Hat has worked with DISA to support CCI, but this does
> not mean that Red Hat is promoting the use of CCI outside of DoD.  Is this
> correct?
>
>
> David Oliva
>
>
> -----Original Message-----
> From: Boyd Ako <boyd.hanalei.ako at gmail.com>
> To: Jan Cerny <jcerny at redhat.com>
> Cc: open-scap-list <open-scap-list at redhat.com>
> Sent: Fri, Jan 11, 2019 8:06 pm
> Subject: Re: [Open-scap] Making Fix Templates
>
> What do you mean by "map" the XCCDFs of SSG and DISA? I've looked into the
> the DISA Vunerability IDs referenceing the CCI/CCEs that it's for. I
> haven't checked it against the SSG XCCDF though.
>
> Yeah... I know the "generate fix" thing is muck. I'm actually having to
> rebuild a system because the script killed my bootloader.
>
> I'm essentially trying to use the "generate fix" functionality using
> external snippets. It's pretty obvious the snippets and the results are not
> that dependable to use on production systems. It's what the template used
> to do. It finds CCI XXX as open and searches the template for function CCI
> XXX and adds the snippet to script. The snippet it's self would also
> "double check" the finding and "fix" the finding in means that you could
> run it over and over again and it'd only do something when the snippet
> actually finds the finding as open.
>
> I get why the snippets are included into the XCCDF. However, it doesn't
> have the ability to take in logic and conditions on a "per system" basis. I
> know that's where the "tailoring" comes in. But that's also to "static". By
> using a template, in the PRE section I can state that "if 3rd IP octet is
> 130 do not run fix for CCI XXX or use value of blah for CCI XXX setting"
> noting some official documentation for exception.
>
> That all being said, all Open SCAP then does is essentially just scan the
> system. And in my work environment the SPAWAR SCC is the more approved
> scanner. And I could make a script to read the results XML and generate a
> fix script like Open SCAP would do. But, that would imply that we don't
> need Open SCAP to begin with and remove a justification for the department
> to purchase Red Hat Satellite. ... However, if I can use the Open SCAP to
> use the stated authorized and approved DISA XCCDF and then use a template
> to fill in the blanks for the finding snippets that would be a means more
> likely to be approved.
>
>
> All the XCCDFs are good for scanning. But, the fixing and remediation is
> where most of the Sys Ads complain. And the XCCDF code snippets are not
> reliable because only a really tiny group of people are able to update the
> XCCDF files; officially. If the template function worked, I'd imagine a
> bunch of people collaborating on making fix templates on GITHUB or where
> ever. The XCCDF file needs to be official and authorized. The fix templates
> do not.
>
>
> ------------------------------
> Thank you for your time,
>
> Boyd H. Ako
>
> boyd.hanalei.ako at gmail.com
> https://www.boydhanaleiako.me
> Cell Phone: (424) 244-9653PGP/GPG Public Key:
> https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
> ------------------------------
>
>
> On Thu, Jan 10, 2019 at 9:27 PM Jan Cerny <jcerny at redhat.com> wrote:
>
> Hi,
>
> I have looked into this quickly. But I haven't able to get that working. I
> haven't found
> anything in the source code that uses it. It seems to me that the feature
> has been removed
> without changing the documentation. I'm not sure if the removal was
> intended or if it is
> a regression.
>
> The "oscap xccdf generate fix" command only extracts the code snippets
> from the input
> XCCDF or DS file. There is no magic logic behind that, it is a very simple
> transformation.
> It doesn't understand or doesn't analyze the rules that are there.
>
> It isn't clear to me what you need. Do you try to map SSG XCCDF to XCCDF
> provided by DISA?
>
> Regards
>
> Jan Černý
> Security Technologies | Red Hat, Inc.
>
> ----- Original Message -----
> > From: "Boyd Ako" <boyd.hanalei.ako at gmail.com>
> > To: open-scap-list at redhat.com
> > Sent: Wednesday, January 9, 2019 1:32:48 AM
> > Subject: [Open-scap] Making Fix Templates
> >
> > Aloha,
> >
> > So I had a couple questions.
> >
> > A) Is using the Fix Template function still being supported?
> >
> > B) Is there more detailed documentation on creating the template? I'm
> already
> > aware of the XSL "legacy" files in /usr/share/openscap/xsl. I seem to be
> > having issues with openscap outputing anything from the
> > legacy-fixtpl-bash.xml as it is or when I try to modify the "fixentry" to
> > map to a rule.
> >
> > C) If the Fix Template function is more or less dead in the water, is
> there a
> > way I can "convey" fixes for the remediation script generation that's
> either
> > local or on premise? I know that OpenSCAP does have a bunch of fixes for
> the
> > SSGs. But I can't really reach them due to isolation and even if I could
> it
> > wouldn't be permitted since it's "external" to "DISA Approved" stuff.
> >
> >
> > My environment: As awesome as it is that there's SSGs for DISA RHEL 7, I
> > can't use it because it doesn't have the MAC and Sensitivity profiles in
> the
> > actual RHEL 7 Benchmark from the DISA XCCDF. So, I'm using the the XCCDF
> > from DISA with the appropriate profile and none of the "rules" seem to
> match
> > any of the remediation fixes for the failed rules. Also due to networking
> > infrastructure, I'm more or less isoalted so fetching remote resources is
> > out.
> >
> >
> >
> >
> > Thank you for your time,
> >
> > Boyd H. Ako
> >
> > boyd.hanalei.ako at gmail.com
> > https://www.boydhanaleiako.me
> >
> >
> >       Cell Phone:     (424) 244-9653 PGP/GPG Public Key:
> >
> https://sks-keyservers.net/pks/lookup?op=get&search=0xC58073B21618F134
> >
> >
> > _______________________________________________
> > Open-scap-list mailing list
> > Open-scap-list at redhat.com
> > https://www.redhat.com/mailman/listinfo/open-scap-list
>
> _______________________________________________
> Open-scap-list mailing list
> Open-scap-list at redhat.com
> https://www.redhat.com/mailman/listinfo/open-scap-list
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/open-scap-list/attachments/20190111/6ab34d7c/attachment.htm>