scap-security-guide November 2016

scap-security-guide@lists.fedorahosted.org

11 participants
11 discussions

RE: VMs, containers vs. bare-metal machines in SSG
by Radzykewycz, T (Radzy) 02 Nov '16

02 Nov '16

> From: Brent Kimberley <Brent.Kimberley(a)Durham.ca> > As opposed to writing one XCCDF, why not write one XCCDF per > point of interest (inside the container of interest, inside the > OS but outside the container of interest, ...) - until upstream > standards address Origin, Point (in SpaceTime), Frame of Reference, > ... for a cyber-physical assembly? When I start working on our container environment, I expect I need to write custom XCCDF and custom OVAL for some of the checks. Some of the management may be done in the container, but I expect most to be done in the underlying host. So paths may be different, which would lead to either more complex OVAL with parameterization, or duplication of the OVAL content. And as implied elsewhere, the XCCDF needs to be modified to indicate the correct information for the environment. Enjoy! -- radzy

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2016