I wanted to bring to your attention a new project on fedorahosted:
It is designed to provide security guidance and checking content in the
SCAP formats. Specifically, the project goal is to produce --- from a
single body of content:
1) an informative prose guide, similar in style to NSA's RHEL 5 guide
2) a desktop settings baseline, similar in style to NIST USGCB
3) a server settings baseline, similar in style to a STIG
4) additional baselines for other network roles (such as LAMP server)
5) a body of automated checking content in the OVAL format
Currently, we are engaged in updating NIST's beta USGCB content for RHEL
5 Desktop to RHEL 6. We continue to evolve simple scripts for creating
and manipulating such content in an agile fashion.
A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov):
To grossly simplify, consider it a set of XML schema that describe
configuration checklists/guides, and also how to carry out checks for
compliance (and patching). Content expressed in the SCAP formats can be
very verbose/ugly, but there is a significant benefit in that a growing
body of commercially available tools can ingest SCAP content and provide
results in standardized formats. For the enterprise, this is very
The OpenSCAP project provides a very important automation/testing and
presentation capabilities for such content, and we use it for guide
generation and unit testing of checks. The scap-workbench project
allows for easy editing and tailoring of such content (for end-users).
When fully developed, we intend to endorse the prose and associated
checking content developed on scap-security-guide as best practice
guidance. As Aqueduct provides deployment resources for compliance with
security baselines from multiple organizations, we would like to
maintain close coordination.
We welcome your participation, particularly if you have information that
you believe represents security best practice for RHEL 6. If you are
familiar with SCAP formats and would like to participate directly in the
creation of XCCDF, OVAL or OCIL content, such expertise is particularly
Please feel free to send questions to the mailing list at
scap-security-guide(a)lists.fedorahosted.org , or directly to me.
NSA Information Assurance
-----BEGIN PGP SIGNED MESSAGE-----
Do we have any rules of the road for wiki etiquette at this point? Should we just update as we see fit? Is there a dedicated maintainer, etc...?
For items that we may want to add to the checks, etc.., should we post a ticket with the idea, or toss it up to the mailing list first?
I'm unfortunately going to be a bit sporadic in terms of participation, but I'll certainly do what I can, when I can.
Vice President, Onyx Point, Inc.
phone: 410-541-ONYX (6699)
- -- This account not approved for unencrypted sensitive information --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-----END PGP SIGNATURE-----