Re: Why exclude unset auid in STIG rules

On Wednesday, May 11, 2016 06:40:52 PM Wyatt, Curtis wrote: This is a complicated topic. Basically there are different levels of paranoia. The STIG in my mind addresses basic robustness. If you read through the SRG, the things its requiring are reasonable but not paranoid. I also think of it as a starting point. You can certainly tighten your system more than the STIG calls out. This is because you have specific knowledge of your operating environment and the threats that go with it. This might be for example knowledge about a daemon you have installed and whether or not its likely to be compromised. You can, with specific knowledge, add rules just for that daemon. But I don't think everyone wants to be held to the needs of a particular setup. I think there is a difference in what rules you would use to spot bad user activity vs the rules you would use for intrusion detection. (I am working on and testing rules for intrusion detection and they will be in an upcoming release.) Perhaps if you feel that this is likely to happen in your environment. You may also wind up with so many events that you cannot see what a rogue employee just did right before they quit. Or so many events that you only can keep the last hour's logs on-hand. I don't see anything in the SRG that leans towards IDS-like rules. Do you see any? -Steve