Greg,
This is GREAT! Definitely some eyebrow rising on my part. I’m clearly not as in-touch as
I wish and your writeup and the GovReady section on github is definitely a welcome
addition. Thank you to you and your team for assembling this and advertising it to this
community.
Charlie Todd
Ball Aerospace & Technologies Corp.
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Greg Elin
Sent: Tuesday, April 21, 2015 4:03 PM
To: SCAP Security Guide
Subject: Re: CentOS / PCI DSS / Vulnerability Scans etc
Nathanael,
I had the same problem getting started with scanning and auditing. Below are a couple of
starting points.
Getting Started with scanning/auditing CentOS 6 with SCAP-Security-Guide
=============================================================
For a quick start on auditing CentOS, see the CentOS 6 QuickStart in the README at:
https://github.com/GovReady/govready<https://urldefense.proofpoint.com...
The QuickStart installs my pure Bourne shell app, "GovReady," which installs
OpenSCAP, SCAP-Security-Guide (SSG). Follow the QuickStart steps to make the adjustments
in the OVAL test so the SSG tests for RedHat will run correctly on CentOS instead of
returning "not applicable" results.
The GovReady toolkit displays all OpenSCAP commands it runs, so it can be helpful little
training tool to acquaint you the specifics of using OpenSCAP.
Getting Started with SCAP-Security-Guide in General
===========================================
Forgive me if this is too basic, but I think it is good to start from zero.
The SCAP-Security-Guide project is a project to produced open-source SCAP (Security
Content Automation Protocol) for RedHat and now other Linux systems.
SCAP is best thought of machine-readable "security content". That is, XML
content describing machine-readable checks for software configuration and
vulnerabilities.
SCAP is composed of several interrelated XML standards (XCCDF, OVAL, OCIL, ARF, CCE, CPE,
CVE, CVSS, CCSS) -- but trying to understand how the why and how of these separate
standards is confusing.
What you really want to do is audit your CentOS server for vulnerabilities and
configuration settings, right? To do that, you need the following:
1. "scanning software" that non-intrusively scans and audits server nerd knob
settings;
2. "security content" (or "SCAP content") that describes the tests to
apply to audit the server;
3. "security report" that indicates which tests passed, which tests failed, and
why.
Examples of "scanning software" include RedHat's OpenSCAP, OpenVAS, FarnHall
Ventures's jOVAL and Teneble's Nessus. Most "security content" is
provided either by a software vendor or by a third party such as Tenable that sells
enterprise scanning software. This list, of course, offers SCAP-Security-Guide, which is
security content in SCAP format with an open source license (Hurray!).
The "security reports" indicating which tests have passed is generally a module
built into the scanning software. Most scanning software also produces standardized XML
reporting results so the content can be aggregated in other tools.
Scanning/auditing a system is not really any different from installing Virus scanning
software and Virus signatures content to scan your computer for viruses. But it's
been my experience that SCAP feels much more complicated. I think there are three reasons
why. First, the government cyber security community is a bit insular by nature. Second,
scanning software is designed for scanning thousands of "end points" in the
enterprise and a lot of knowledge is assumed. Finally, SCAP has not yet been packaged to
be user friendly and has a steep learning curve as a standard. (It's easy to get to
over 8 standards when you are trying to juggle different platforms, supporting variables,
standardized tracking of vulnerabilities, etc.)
Anyway, the whole point of SCAP is to automate security scanning, to have computers check
other computers. That process involves the following steps:
1. Install NIST-certified SCAP scanning software
2. Download/install desired SCAP Content (e.g. security content) for your platform
3. Choose the correct profile (e.g., checklist of tests)
4. Run the scan
5. Look at results
6. Fix results
7. Repeat as necessary
Here are some links that discuss the specifics of these seven steps.
-
http://github.com/govready<https://urldefense.proofpoint.com/v2/url?u=...
- a toolkit designed to make server auditing friendly to developers use to work with
Git.
-
http://myopensourcelife.com/2013/09/08/scap-and-remediation/<https://u...
(ignore the installation information and jump down to "running a scan" to see
commands
-
http://people.redhat.com/swells/docs/en-US/SCAP_Security_Guide/0.1/html-s...
- the SSG manual
It is pretty easy to install the scanning software of your choice, but it can be a real
challenge to finding the SCAP content for your platform. Lots of SCAP is proprietary, but
the SCAP-Security-Guide is working to make more scanning content available for more
platforms under open source licenses. (Or at least, I think of it that way.)
A big gotcha that I ran into with SCAP-Security-Guide is the fact that tests are
associated with RedHat platform specifically. (One of the SCAP standards, CPE, or Common
Platform Enumeration, provides an explicit way of universally identifying a platform. And
the SSG basic distribution tests for RedHat. So it is necessary to adjust CPE-dictionary
file and the associated CPE test in the OVAL XML to get RedHat SSG tests to work properly
on CentOS.)
Send more questions if you have them...
best,
Greg Elin
GovReady PBC
e gregelin@gitmachines
m 917-304-3488
On Mon, Apr 20, 2015 at 2:24 PM, Nathanael D. Noblet
<nathanael@gnat.ca<mailto:nathanael@gnat.ca>> wrote:
Hello,
We tend to use CentOS for most of our servers. All legacy servers are
6, we have two new v7 servers.
I would like to learn how to perform some of these audits that the
guide provides. I looked at it a few months back but never got to the
point of having it work successfully.
Does anyone know of documentation on how to use the guide with CentOS?
I know v7 isn't quite ready? I'm also wondering if there are public
locations for standards like PCI DSS, HIPAA, or other high security
'generally accepted' standards etc.
--
Nathanael
--
SCAP Security Guide mailing list
scap-security-guide@lists.fedorahosted.org<mailto:scap-security-guide@lists.fedorahosted.org>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide<ht...
https://github.com/OpenSCAP/scap-security-guide/<https://urldefense.pr...
This message and any enclosures are intended only for the addressee. Please
notify the sender by email if you are not the intended recipient. If you are
not the intended recipient, you may not use, copy, disclose, or distribute this
message or its contents or enclosures to any other person and any such actions
may be unlawful. Ball reserves the right to monitor and review all messages
and enclosures sent to or from this email address.