Re: [Fed-Talk] NSA has released the
Re: [Fed-Talk] NSA has released the
- Subject: Re: [Fed-Talk] NSA has released the
- From: Brian Raymond <email@hidden>
- Date: Tue, 09 Nov 2004 09:25:51 -0500
You summed up what I think a lot of people overlook, FISMA and the NSA
OX security guidelines are just that, guidelines. Neither can be
considered the definitive source of what is needed to maintain either a
class or unclass system in one's environment, but they definitely help a
site get there. I say site because when it comes down to it the local
DAA is where the buck stops most of the time. Something considered
"secure" at one site is by no means secure at the next.
- Brian
Cole, John (Civ, ARL/CISD) wrote:
Michael, et al.,
As always, security controls are applied as needed. The system concerned
has to be categorized according to criticality of the system
functionality and the information on the system. And following the
guidance of FISMA, security has to be cost effective after the
consideration of the systems categorization. The config guide provides a
buffet of controls, but it should not be viewed as a black and white
offering or requirement for classified or unclass systems. Instead, it
points out vulnerabilities and controls to counter those.
The job of selecting approriate controls (with resulting consequences)
is left to the reader.
Jack
The only truly secure system is one that is powered off, cast in a block
of concrete and sealed in a lead-lined room with armed guards - and
even then I have my doubts. (A. K. Dewdney in Scientific American,
March 1989, pp 110, "Computer Recreations: Of Worms, Viruses and Core
War")
-----Original Message-----
From: fed-talk-bounces+cole=email@hidden
[mailto:fed-talk-bounces+cole=email@hidden] On Behalf Of
Michael Kluskens
Sent: Monday, November 08, 2004 5:12 PM
To: email@hidden
Subject: Re: [Fed-Talk] NSA has released the
On Nov 8, 2004, at 11:56 AM, Robert Gordon wrote:
Apple Mac OS X v 10.3.x Panther Security Configuration Guide. This
guide explains all that is needed to secure a Macintosh in a
Classified environment.
That document is not limited to the classified environment, in fact I
have not been able to find anything that even implies it is. I find a
lot of information that implies it is intended for the unclassified
Internet connected environment.
It is primarily intended for locally-administered OS X 10.3 systems.
There has long been a similar document for Windows NT, 2000, and XP,
our people used them to create security templates for all our Internet
connected Windows machines.
Michael
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden