Mapping from DISA Stig references to Mitre CCE reference #s

[Carolyn Rowland]

Community,

I don't suppose anyone has a mapping between the DISA STIG GEN numbers
referenced in the Cfengine stigs.cf stig_README.txt and the Mitre CCE
nubmers.

My agency uses Mitre CCE reference numbers in it's configuration
requirements, not the Stig GEN00xxx numbers so we are having trouble
using the cfengine stig examples.

Thanks,
Carolyn

[Diego Zamboni]

Hi Carolyn,

I don't know of such a mapping, and couldn't find one in a quick search.

I suppose in principle it might be possible to generate it because CCE includes references, but AFAICT, all STIG references it includes are to the STIG for Windows 2003, I couldn't see any references to STIG for Unix.

BTW do you know where STIG is now? The old page at http://iase.disa.mil/stigs/ seems to be gone.

--Diego

> _______________________________________________
> Help-cfengine mailing list
> Help-c...@cfengine.org
> https://cfengine.org/mailman/listinfo/help-cfengine

[Carolyn Rowland]

Diego,

It looks like http://iase.disa.mil/stigs/ has been updated recently
(today).

Right, we couldn't find any CCE lists that had mappings to the Linux
STIG references. I guess we'll do some regex to figure out which
controls map from the cfengine STIG samples to the CCE table we have to
use.

Carolyn

[Michael Pelletier]

The CCE designates a configuration point, while the STIG directs how that configuration point should be set, so the CCE and the STIG reference numbers serve different purposes. You may want to point this out to your folks, Carolyn. If a given CCE id needed to be set one way on one platform but another way on another, they'd have the same CCE but a different DISA GEN number.

In a version of a STIG that I found yesterday it had cross-references to the CCE numbers, let's see... Ah, here's something - the RHEL5 Benchmark 2.0 document contains a CCE reference for each item. Here's a copy on Scribd:

http://www.scribd.com/doc/84089960/69/Set-Boot-Loader-Password

So yeah, to get a mapping from CCE to RHEL5 STIG numbers it looks like you'd need to sift it out of a document, unfortunately. The CCE reference list for RHEL5 from this page:

http://cce.mitre.org/lists/cce_list.html

... cross-references section numbers of the NSA guide, but doesn't cross-reference the DISA STIG. You may want to poke the Mitre folks, though, to see if they're working on something so you don't duplicate effort.

     -Michael Pelletier.

[Michael Pelletier]

It's the NSA guide I found yesterday which has a list of CCE cross-references for each item:

http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf

   -Michael Pelletier.