On 7/3/12 6:52 PM, Willy Santos wrote:
CCI-001158 requires validating the integrity of security attributes exchanged between systems. This mapping is a request for input/discussion.

Signed-off-by: Willy Santos <wsantos@redhat.com>
---
 rhel6/src/input/auxiliary/srg_support.xml |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/rhel6/src/input/auxiliary/srg_support.xml b/rhel6/src/input/auxiliary/srg_support.xml
index 6261c13..4b00156 100644
--- a/rhel6/src/input/auxiliary/srg_support.xml
+++ b/rhel6/src/input/auxiliary/srg_support.xml
@@ -38,7 +38,7 @@ The requirement is impractical or out of scope.
 <description>
 It is unclear how to satisfy this requirement.
 </description>
-<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157" />
+<ref disa="20,31,218,219,224,1097,1159,1125,1126,1140,1143,1149,1157,1158" />
 </Group> <!-- end requirement_unclear -->
 
 <Group id="new_rule_needed">

SRG-OS-000178 CCI-001158 The operating system must validate the integrity of security attributes exchanged between systems. When data is exchanged between information systems, the security attributes associated with the data needs to be maintained. Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information; typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Security attributes may be explicitly or implicitly associated with the information contained within the information system.

I'm leaning towards impractical_guidance by associating this with implementing CCI-001157.

But I'm also leaning towards saying the integrity is validated through the fact all connections are encrypted via OpenSSL and mapping this to use_ssl (or whatever we called it).

Both seem valid to me... need someone to be the tie breaker (Cliff, Jeff, Joe?).