scap-security-guide: building SCAP content for RHEL 6
by Jeffrey Blank
Aqueduct list,
I wanted to bring to your attention a new project on fedorahosted:
https://fedorahosted.org/scap-security-guide
It is designed to provide security guidance and checking content in the
SCAP formats. Specifically, the project goal is to produce --- from a
single body of content:
1) an informative prose guide, similar in style to NSA's RHEL 5 guide
2) a desktop settings baseline, similar in style to NIST USGCB
3) a server settings baseline, similar in style to a STIG
4) additional baselines for other network roles (such as LAMP server)
5) a body of automated checking content in the OVAL format
Currently, we are engaged in updating NIST's beta USGCB content for RHEL
5 Desktop to RHEL 6. We continue to evolve simple scripts for creating
and manipulating such content in an agile fashion.
A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov):
To grossly simplify, consider it a set of XML schema that describe
configuration checklists/guides, and also how to carry out checks for
compliance (and patching). Content expressed in the SCAP formats can be
very verbose/ugly, but there is a significant benefit in that a growing
body of commercially available tools can ingest SCAP content and provide
results in standardized formats. For the enterprise, this is very
significant.
The OpenSCAP project provides a very important automation/testing and
presentation capabilities for such content, and we use it for guide
generation and unit testing of checks. The scap-workbench project
allows for easy editing and tailoring of such content (for end-users).
When fully developed, we intend to endorse the prose and associated
checking content developed on scap-security-guide as best practice
guidance. As Aqueduct provides deployment resources for compliance with
security baselines from multiple organizations, we would like to
maintain close coordination.
We welcome your participation, particularly if you have information that
you believe represents security best practice for RHEL 6. If you are
familiar with SCAP formats and would like to participate directly in the
creation of XCCDF, OVAL or OCIL content, such expertise is particularly
valued.
Please feel free to send questions to the mailing list at
scap-security-guide(a)lists.fedorahosted.org , or directly to me.
Thanks,
Jeff
___________________________
Jeffrey Blank
410-854-8675
Global Mitigations
NSA Information Assurance
11 years, 8 months
A few questions.
by Trevor Vaughan
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
All,
Do we have any rules of the road for wiki etiquette at this point? Should we just update as we see fit? Is there a dedicated maintainer, etc...?
For items that we may want to add to the checks, etc.., should we post a ticket with the idea, or toss it up to the mailing list first?
I'm unfortunately going to be a bit sporadic in terms of participation, but I'll certainly do what I can, when I can.
Thanks!
Trevor
- --
Trevor Vaughan
Vice President, Onyx Point, Inc.
email: tvaughan(a)onyxpoint.com
phone: 410-541-ONYX (6699)
pgp: 0x6C701E94
- -- This account not approved for unencrypted sensitive information --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAEBAgAGBQJOaYl5AAoJECNCGV1OLcypWU0IAIY5y2/W4kU4XKirpbgJnNRa
G5tchWFzxiKrS9XQe8TiZWNNYMmmbbZxy05SRku3FSf0zTIZsiUqRxoQaZsPqsb4
seWwZmyu/DUYJD9UGGSJAb9Zy7NWoPZYDMdfz5OJw6bRGy1LQRUofwmxsFlydtuU
xWCLm1XZO9HpU459SAEQKUqMY8SI90l2t18j5I8PZTgYETtWqE9LUOj1eENC/INi
2hd99asvhH+PLOujw1UOmCrApeqVvt6PYWAbTk/3U4y8trUo3H6JJRJvbAJnEZdS
SbHlPogY+WQPG1QREi5SgbeLUG+sjBxjUradPoCo/LPlKuZMf0OGXerzKQqDnGo=
=6Eot
-----END PGP SIGNATURE-----
11 years, 8 months