Learning about this baselines and SCAP over past year+ has been confusing.
So I like idea of re naming and rebranding to improve adoption and use.
SCAP, SSG, SSP, etc. I have been in IT for 20 years and have worked for telcos and fed
gov. Though I am no stranger to acronyms, SSG is very confusing bc of SSP and not in a
good way. OpenSCAP Security Guide remains confusing. Is OpenSCAP a definer of security
configuration baselines itself?
I thought OpenSCAP is a tool that can interpret any guide (eg profile) written in SCAP,
If I follow SSG do I immediately get a baseline for Federal Desktop or Server? My current
understanding is "kinda" only bc the default profile is base on it but "not
really" bc you can change the profiles and you are suppose to.
It seems to me OpenSCAP is a tool. And any Guide must be tied to a baseline config from an
authority with ability to accept and bless implementations and tests of that config. As a
developer or Auditor, isn't what I care about the is the configuration as per an
authority issue and approving it?
Sent from my iPhone
On Apr 30, 2014, at 7:14 PM, Steve Grubb <sgrubb(a)redhat.com>
> On Wednesday, April 30, 2014 10:08:04 AM Jan Lieskovsky wrote:
> Since there's effort to create OpenSCAP ecosystem, of which SCAP security
> guide project is its indisputable part, besides cloning the repository, the
> other natural subsequent step, coming to mind is to have the project
> renamed from SCAP security guide to OpenSCAP security guide.
While the SSG project uses oscap to manipulate the xml, the results are by no
means exclusive to openscap. I think the resulting documents should be tool
neutral. IOW, its part of a bigger ecosystem "as is".
scap-security-guide mailing list