On 4/18/14, 3:14 PM, Greg Elin wrote:
Greetings all --
I became involved with SCAP and SSG as part of grant from the Knight
Foundation to support government innovation by creating tools and
servers that meet government regulations, so that developers can
easily build and adopt new technology. (More here:
http://www.knightfoundation.org/grants/201345714/)
Basically, I want leverage SCAP so developers start with
accreditation-ready environments and security is baked into the
development process.
Right now, I am focusing on a "GovReady" toolkit so people can more
easily add SCAP and vulnerability scanning into their projects; and a
GovReady Clearinghouse of content to help people find ready versions
of software.
*I'm looking for a few volunteers to provide ongoing feedback on the
prototypes we are building. *
*
*
*Anyone interested in seeing early prototypes and providing feedback?*
We want to make the content easier for everyone to work with: Security
folks, administrators, developers, even business side.
Thanks!
For those in the broader SSG community, I had the chance to speak with
Greg awhile back. Some here may know him from his former life as the
Chief Data Officer at the FCC. GitMachine's goals greatly align with SSG.
Greg, to perhaps provide some engagement, could you outline:
- How is your work different than Red Hat providing STIG'd and otherwise
hardened (e.g. C2S) AMIs?
- How are your tools different than preexisting hardening scripts, which
configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct
and
github.com/redhatgov)?
- What other components make a "GovReady" toolkit?
- To better understand how the SSG community could help, how does SSG
fit into your work?