Regulatory Compliance remediation for CCE-37861-2 suggests opposite of the standard.

%3CLINGO-SUB%20id%3D%22lingo-sub-2247297%22%20slang%3D%22en-US%22%3ERegulatory%20Compliance%20remediation%20for%20CCE-37861-2%20suggests%20opposite%20of%20the%20standard.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2247297%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20run%20a%20PCI%20DSS%20compliance%20report%2C%20and%20one%20of%20the%20items%20is%20the%20opposite%20of%20what%20they%20should%20be%2C%20for%20example%2C%20I%20have%20fails%20on%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECCE-37861-2%20Ensure%20'Windows%20Firewall%3A%20Public%3A%20Settings%3A%20Apply%20local%20firewall%20rules'%20is%20set%20to%20'No'%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20%22%3CSPAN%3ERemediate%20security%20configurations%22%20requires%20that%20I%20set%20it%20to%20%22Yes%22%2C%20where%20as%20in%20my%20environment%26nbsp%3Bthey%20are%20set%20to%20%22No%22%20as%20per%20both%20CCE-37861-2%20and%20CIS%209.3.5%20(Server%202012).%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EIs%20this%20just%20a%20mistake%20simple%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

I have run a PCI DSS compliance report, and one of the items is the opposite of what they should be, for example, I have fails on:

 

CCE-37861-2 Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'

 

The "Remediate security configurations" requires that I set it to "Yes", where as in my environment they are set to "No" as per both CCE-37861-2 and CIS 9.3.5 (Server 2012).

 

Is this just a simple mistake?

0 Replies