From 4f05bd24d28bfde10b204672006d5a3999a88d27 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 11:44:46 -0600 Subject: [PATCH 1/7] Removal SRG GPOS Controls based on V32 --- controls/srg_gpos/SRG-OS-000047-GPOS-00023.yml | 16 ---------------- controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml | 10 ---------- 2 files changed, 26 deletions(-) delete mode 100644 controls/srg_gpos/SRG-OS-000047-GPOS-00023.yml delete mode 100644 controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml diff --git a/controls/srg_gpos/SRG-OS-000047-GPOS-00023.yml b/controls/srg_gpos/SRG-OS-000047-GPOS-00023.yml deleted file mode 100644 index 360021260f1..00000000000 --- a/controls/srg_gpos/SRG-OS-000047-GPOS-00023.yml +++ /dev/null @@ -1,16 +0,0 @@ -controls: - - id: SRG-OS-000047-GPOS-00023 - levels: - - medium - title: {{{ full_name }}} must shut down by default upon audit failure (unless - availability is an overriding concern). - rules: - - audit_rules_system_shutdown - - var_audit_failure_mode=panic - - auditd_data_disk_error_action_stig - - var_auditd_disk_error_action=halt - - auditd_data_disk_full_action_stig - - var_auditd_disk_full_action=halt - - auditd_data_retention_max_log_file_action_stig - - var_auditd_max_log_file_action=rotate - status: automated diff --git a/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml b/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml deleted file mode 100644 index 59fe04a46b4..00000000000 --- a/controls/srg_gpos/SRG-OS-000805-GPOS-00260.yml +++ /dev/null @@ -1,10 +0,0 @@ -controls: - - id: SRG-OS-000805-GPOS-00260 - title: '{{{ full_name }}} must employ automated patch management tools to facilitate - flaw remediation to the organization-defined system components.' - levels: - - medium - status: automated - rules: - - dnf-automatic_apply_updates - - package_dnf-automatic_installed From 8b141a8f45a07465d9d29fd98a00dc63ea9493f0 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 11:47:02 -0600 Subject: [PATCH 2/7] Update SRG-OS-000355-GPOS-00143 for SRG GPOS V3R2 --- controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml b/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml index 62dbeff86c2..c495782770c 100644 --- a/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml +++ b/controls/srg_gpos/SRG-OS-000355-GPOS-00143.yml @@ -1,10 +1,7 @@ controls: - id: SRG-OS-000355-GPOS-00143 title: '{{{ full_name }}} must, for networked systems, compare internal information - system clocks at least every 24 hours with a server which is synchronized to one - of the redundant United States Naval Observatory (USNO) time servers, or a time - server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the - Global Positioning System (GPS).' + system clocks at least every 24 hours with an authoritative time source.' levels: - medium From d968a8dd8fa7a7257ff35670b1e17f825d1e25a3 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 11:50:25 -0600 Subject: [PATCH 3/7] Add SRG-OS-000373-GPOS-00157 --- controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml diff --git a/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml b/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml new file mode 100644 index 00000000000..65f5ef58233 --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000373-GPOS-00157.yml @@ -0,0 +1,6 @@ +controls: + - id: SRG-OS-000373-GPOS-00157 + levels: + - medium + title: '{{{ full_name }}} must require users to reauthenticate when changing roles.' + status: pending From a6df9146a67148c434aacda5210dc7c5d727be7c Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 11:53:24 -0600 Subject: [PATCH 4/7] Add SRG-OS-000373-GPOS-00158 --- controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml diff --git a/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml b/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml new file mode 100644 index 00000000000..3407f0f739d --- /dev/null +++ b/controls/srg_gpos/SRG-OS-000373-GPOS-00158.yml @@ -0,0 +1,7 @@ +controls: + - id: SRG-OS-000373-GPOS-00158 + levels: + - medium + title: "{{{ full_name }}} must require users to reauthenticate when + changing authenticators." + status: pending From 93861d5543ce5c8e60ca8302da3f64d92c919968 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 12:02:05 -0600 Subject: [PATCH 5/7] Fix title in SRG-OS-000076-GPOS-00044 --- controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml b/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml index 8e65bb7a1bf..842cbe55598 100644 --- a/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml +++ b/controls/srg_gpos/SRG-OS-000076-GPOS-00044.yml @@ -1,6 +1,6 @@ controls: - id: SRG-OS-000076-GPOS-00044 - title: Operating systems must enforce a 60-day maximum password lifetime restriction. + title: {{{ full_name }}} must enforce a 60-day maximum password lifetime restriction. levels: - medium rules: From 6476cbc2238c2069a85c0d690a5c359c610c0bd4 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Jan 2025 12:04:39 -0600 Subject: [PATCH 6/7] Update to SRG GPOS V3R2 --- ...a-os-srg-v3r1.xml => disa-os-srg-v3r2.xml} | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) rename shared/references/{disa-os-srg-v3r1.xml => disa-os-srg-v3r2.xml} (86%) diff --git a/shared/references/disa-os-srg-v3r1.xml b/shared/references/disa-os-srg-v3r2.xml similarity index 86% rename from shared/references/disa-os-srg-v3r1.xml rename to shared/references/disa-os-srg-v3r2.xml index 6a4684c3d3e..233968c4b29 100644 --- a/shared/references/disa-os-srg-v3r1.xml +++ b/shared/references/disa-os-srg-v3r2.xml @@ -1,4 +1,4 @@ -acceptedGeneral Purpose Operating System Security Requirements GuideThis Security Requirements Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 24 Jul 20243.51.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>