From shawn at redhat.com Thu Aug 20 11:36:36 2015 Content-Type: multipart/mixed; boundary="===============8334541016132739654==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH][docs] editing the SSG workbook Date: Wed, 05 Mar 2014 19:39:35 -0500 Message-ID: <5317C3C7.6020901@redhat.com> In-Reply-To: 3E81765C-9515-4D69-BC3B-AA3EEA439783@secure-innovations.net --===============8334541016132739654== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 3/5/14, 4:17 PM, David Smith wrote: > This patch set covers the following sections of the SSG workbook (docs/SC= AP_and_STIG_Workshop): > > - Book Info > - Introduction > - The SCAP Security Guide > - Understanding the Components > > Most of the changes are copy editing, but there is some content revision = - making the prose more relevant in 2014, reflecting the current collection= of profiles in the RHEL6 XCCDF, etc. More patches to follow in the coming= days. > > > From 72d24530024dcb0f58fb5289a8ae180afd8e8298 Mon Sep 17 00:00:00 2001 > From: David Smith > Date: Wed, 5 Mar 2014 12:27:32 -0800 > Subject: [PATCH][docs] workbook editing - part 1 > > > Signed-off-by: David Smith > --- > docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml | 2 +- > docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml | 2 +- > .../en-US/SCAP_Security_Guide_Project.xml | 12 ++++++------ > 3 files changed, 8 insertions(+), 8 deletions(-) > > diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml = > b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml > index 0d641bb..8d9bf98 100644 > --- a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml > +++ b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml > @@ -5,7 +5,7 @@ > ]> > id=3D"book-Documentation-SCAP_and_STIG_Workshop-SCAP_and_STIG_Workshop"> > SCAP and STIG Workshop > - An introduction into using and customizing SCAP content = > for Red Hat Enterprise Linux > + An introduction to using and customizing SCAP content = > for Red Hat Enterprise Linux > > SCAP Security Guide > diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml = > b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml > index 4618a51..deb3e06 100644 > --- a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml > +++ b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml > @@ -9,7 +9,7 @@ > This workshop is intended to assist you in developing familiarity = > with, and skill in, the installation and customization of SCAP content = > for Red Hat Enterprise Linux, utilizing the DISA STIG baseline. Upon = > completion of this workshop, you should be able to return to your = > shop, obtain the SCAP components from Red Hat and DISA FSO, and be = > able to perform highly automated STIG scanning and reporting. Each = > attendee will be given a virtual machine to use for this workshop. The = > hostnames follow the syntax of: > studentX.scapworkshop.com > > - The initial login will be studentX, with a password of = > =E2=80=9Cpassword.=E2=80=9D The root password is =E2=80=9Credhat=E2=80=9D= . This workshop has been = > designed to be delivered over a two hour period, with each chapter = > building upon the prior. Should you have any questions, please raise = > your hand and the instructor(s) will be happy to assist. > + The initial login will be "studentX", with a password of = > =E2=80=9Cpassword=E2=80=9D. The root password is =E2=80=9Credhat=E2=80=9D= . This workshop has been = > designed to be delivered over a two hour period, with each chapter = > building upon the prior. Should you have any questions, please raise = > your hand and the instructor(s) will be happy to assist. > > > > diff --git = > a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml = > b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml > index 99f8740..40106b9 100644 > --- a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml > +++ b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml > @@ -6,7 +6,7 @@ > id=3D"chap-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Proje= ct"> > SCAP Security Guide Project > > - The SCAP Security Guide (SSG) Project = > delivers security guidance, baselines, and associated validation = > mechanisms using the Security Content Automation = > Protocol (SCAP). We currently provide content for = > Red Hat Enterprise Linux 6 (RHEL6) and = > JBoss Enterprise Application Server 5 (JBoss = > EAP5). Other technologies are planned, such as KVM and Red Hat = > Storage, in CY2013. > + The SCAP Security Guide (SSG) Project = > delivers security guidance, baselines, and associated validation = > mechanisms using the Security Content Automation = > Protocol (SCAP). We currently provide content for = > Red Hat Enterprise Linux 6 (RHEL6), = > Fedora, and JBoss Enterprise = > Application Server 5 (JBoss EAP5). Other technologies are = > planned, such as KVM and Red Hat Storage, in CY2014. > > > The SSG project aspires to bridge the gap between generalized = > policy and specific implementation guidance, in SCAP formats to = > support automation whenever possible. > @@ -17,23 +17,23 @@ >
id=3D"sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Proje= ct-Background"> > Background > > - Security guidance documents, such as the NSA RHEL5 SNAC = > Guide, have historically been authored in archaic static formats such = > as PDF files. This left much to be desired, particularly around = > automation, and individual shops were forced to create their own = > scripted hardening processes. These processes were authored in their = > own silos, by unique contractor teams, generally not shared across = > programs, and caused gross waste of tax payer dollars. Additionally, = > from a vendor perspective, supporting hardened environments was = > commercially unfeasible. As each shop held it's own processes, how = > could the vendor know what was changed and how to support it? The = > system was broke. > + Security guidance documents, such as the NSA RHEL5 SNAC = > Guide, have historically been authored in archaic and static formats = > such as PDF files. This left much to be desired, particularly around = > automation, and individual shops were forced to create their own = > scripted hardening processes. These processes were authored in their = > own silos, by unique contractor teams, generally not shared across = > programs, and caused gross waste of taxpayer dollars. Additionally, = > from a vendor perspective, supporting hardened environments was = > commercially unfeasible. As each shop held its own processes, how = > could the vendor know what was changed and how to support it? The = > system was broken. > > > - In May 2011, the Information Assurance = > Directorate of the National Security Agency (NSA IAD) = > invited Red Hat to begin collaboration on high quality security = > guidance for RHEL6. It was decided the content would be authored in = > SCAP formats to support automation, and thus the SCAP Security Guide = > project was born. > + In May 2011, the Information Assurance = > Directorate of the National Security Agency (NSA IAD) = > invited Red Hat to collaborate on the development of high quality = > security guidance for RHEL6. It was decided the content would be = > authored in SCAP formats to support automation, and thus the SCAP = > Security Guide project was born. > > > - Development of security guidance continued through May = > 2012, at which point Red Hat and NSA IAD contacted DISA Field Security = > Operations (DISA FSO) to begin development of the Red Hat Enterprise = > Linux 6 STIG. For the first time content development of a STIG would = > be open sourced. The movement towards transparent collaboration =E2=80=93 = > between government agencies, industrial base partners, and content = > consumers =E2=80=93 further reflects acceptance by the NSA and DISA FSO o= f the = > benefits of open source development models. On February 12th, 2013, = > DISA FSO released the first public Draft RHEL6 STIG which was derived = > from the upstream SCAP Security Guide project. > + Development of security guidance continued through May = > 2012, at which point Red Hat and NSA IAD contacted DISA Field Security = > Operations (DISA FSO) to begin development of the Red Hat Enterprise = > Linux 6 STIG. For the first time content development of a STIG would = > be open sourced. This movement towards transparent collaboration =E2=80= =93 = > between government agencies, industrial base partners, and content = > consumers =E2=80=93 further reflects acceptance by the NSA and DISA FSO o= f the = > benefits of open source development models. On February 12th, 2013, = > DISA FSO released the Draft RHEL6 STIG -- derived from the upstream = > SCAP Security Guide project. > > > - This community powered innovation model has allowed the = > rapid creation of security baselines at dramatically reduced costs, = > shortened timeframes, and (arguably) has produced higher-quality = > content that has now become official U.S. Government standards. > + This community driven innovation model has allowed the = > rapid creation of security baselines at dramatically reduced costs, = > shortened timeframes, and has produced higher-quality content that has = > produced official U.S. Government baselines and standards. > >
> >
id=3D"sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Proje= ct-Project_Charter"> > Project Charter > > - The SSG community has a single goal: Develop usable = > security baselines across all Red Hat technology areas. Patches welcome! > + The SSG community has a single goal: developing usable = > security baselines across all Red Hat technology areas. Patches are = > welcome! > >
>
id=3D"sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Proje= ct-Installation"> > -- = > 1.7.1 > > From 485ff3ec2ce0128430310c3d15c1cd05ca718f53 Mon Sep 17 00:00:00 2001 > From: David Smith > Date: Wed, 5 Mar 2014 12:51:30 -0800 > Subject: [PATCH][docs] workbook editing - part 2 > > > Signed-off-by: David Smith > --- > .../en-US/Understanding_the_Components.xml | 21 = > ++++++++++--------- > 1 files changed, 11 insertions(+), 10 deletions(-) > > diff --git = > a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml = > b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml > index e1e7369..94d0f57 100644 > --- a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml > +++ b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml > @@ -50,7 +50,7 @@ > OpenSCAP > The SCAP protocol suite contains multiple complex data = > exchange formats that are used to transmit important vulnerability, = > configuration, and other security data. Historically there have been = > few tools that provide a way to query this data in the needed format. = > This lack of tools makes the barrier to entry very high and = > discourages adoption of these protocols by the community. It's the = > goal of the OpenSCAP project to create a framework of libraries and = > tools to improve the accessibility of SCAP > and enhance the usability of the information it presents. > - SCAP is a protocol, akin to HTML, and consumers must = > use a protocol interpreter. OpenSCAP provides that functionality for = > the RHEL platform. > + SCAP is a protocol, akin to HTML, and consumers must = > use a protocol interpreter. OpenSCAP provides that functionality for = > Red Hat platforms. > The OpenSCAP homepage can be found at url=3D"http://www.open-scap.org/page/Main_Page" /> >
>
id=3D"sect-Documentation-SCAP_and_STIG_Workshop-Understanding_the_compone= nts-XCCDF"> > @@ -145,20 +145,21 @@ and enhance the usability of the information it = > presents. > XCCDF rules are logically organized into profiles. = > To query which profiles are contained within the SCAP Security Guide = > project, run the following command: > > $ grep -n "<Profile" = > /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml > -12: <Profile id=3D"test"> > -68: <Profile id=3D"common"> > -345: <Profile id=3D"desktop" extends=3D"common"> > -381: <Profile id=3D"server" extends=3D"common"> > -389: <Profile id=3D"ftp" extends=3D"server"> > -403: <Profile id=3D"stig-rhel6-server" extends=3D"common"> > +40: <Profile id=3D"test"> > +67: <Profile id=3D"CS2"> > +398: <Profile id=3D"common"> > +613: <Profile id=3D"server"> > +832: <Profile id=3D"stig-rhel6-server"> > +1101: <Profile id=3D"usgcb-rhel6-server"> > +1360: <Profile id=3D"rht-ccp"> > > > - If you were to view line 403 and those proceeding, = > you will see a sampling of which rules make up the stig-rhel6-server = > profile: > + >
> >
> -- = > 1.7.1 > ack & thanks! --===============8334541016132739654==--