[Open-scap] NIST 800-53 identifiers

[Simon Lukasik]

On 03/12/2014 02:45 AM, Shawn Wells wrote:
> On 3/11/14, 6:15 PM, Kordell, Luke T wrote:
>> Hello,
>>
>>       I noticed that the majority of the rule definitions now have
>> NIST 800-53 identifiers or an empty set of quotes where an identifier
>> will be added. Is there a way to get the already-added identifiers to
>> show-up on the .html scan results? At the moment all I can see is the
>> CCE number.
>>
>> Thanks,
>>
>> Luke K
>
> (cross posting to open-scap-list since this is of interest to both
> communities, and the OpenSCAP guys are in the position to affect change)
>
> This comes up frequently. From a content perspective the NIST 800-53
> (+STIG) identifiers are handled in the <ref> tags. It's a matter of
> having the tool (e.g. OpenSCAP) place them into the results file. I
> recall a thread about this, however couldn't easily find it.
>
> So, for the OpenSCAP guys: within SSG we utilize the <ref> tag to map
> additional policy regimes to XCCDF rules. Is there a way to get this
> information exposed within result files?
>

Hello,

We can add these identifiers to the HTML report. How should it look like?

For example Rule named "umask_for_daemons" contains reference to AC-6. 
The output now looks:

"""
     Security identifiers
        * CCE-27031-4
"""

Once we include 800-53 references it could look like:

"""
     Security identifiers
        * Security Control ID (NIST SP 800-53): AC-6
        * CCE-27031-4
"""

Does that look reasonable to you? Do you have better suggestions?

Thanks!

-- 
Simon Lukasik
Security Technologies, Red Hat, Inc.