Thanks for those questions. My response tl;dr.

- How is your work different than Red Hat providing STIG'd and otherwise hardened (e.g. C2S) AMIs?

A. Great minds think a like! The idea for accreditation-ready virtual machines was pitched in Spring 2013 when nobody (that I knew) was providing STIG'd and hardened AMIs.The guidance was there, but you the VMs were not. A correctly configured OS is 80%+ of the battle. Once the OS is handled, there is still (a) producing configurations for the application stack and (b) producing the required FISMA paperwork artifacts. I think the other difference is being able to move pre-configured, pre-hardened architectures. The final difference is improving the UI of the scans and tools. 


- How are your tools different than preexisting hardening scripts, which configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct and github.com/redhatgov)?

A. The biggest difference was to combine these existing hardening scripts with the DevOps orchestration software (e.g., Puppet, Chef, Ansible), in order to create one-click, build, install, scan, generate paperwork systems. The existing tools are not currently found as part of Bitname downloadable stacks for example. Also, most of the scripts are focused just on the OS. But if your are going to be using Wordpress you have to deal with Linux, Apache, Mysql, PHP,  Wordpress, and possibly Wordpress plugins. From what I can tell most of the SCAP content stops at OS. We have STIG material for Apache and Wordpress, but it seems narrative and not SCAP. 


- What other components make a "GovReady" toolkit? 

A. Let describe use case first, then components. On May 31, thousands of "civic hackers" will gather for the National Day of Civic Hacking. That's on top of the hundreds of thousands of civic hackers participating in open government challenges and events around the world (plus commercial companies). Because these civic hackers have no experience with FISMA or STIGs or SCAP, it is rare their work can ever be used by government. But we can use SCAP and SSG and DevOps to change that. In this use case, GovReady packages up SCAP and an open source vulnerability scanner like RATS or openVAS (eager for suggestions) to provide civic hackers with a basic but powerful DIY vulnerability assessment tool. A civic hacker who wants to use NodeJS visits GovReady.org to find the version of NodeJS government is using and a virtual machine (or link to AMI) that is already properly STIG'd. GovReady is included, too, Now the user can easily produce an XCCDF that demonstrates the application is mostly or completely hardened.


- To better understand how the SSG community could help, how does SSG fit into your work?

A. The SCAP Security Guide is essential! It's the entire base! Cybersecurity cannot be left to contractors, or expensive enterprise products. For everyone to be in compliance, compliance has to be openly and automatically available to everyone. More than anything I hoped that I could use SSG and Aquaduct to make it a snap to give people accreditation-ready virtual machines; that I would just need to mashup a few existing projects to change the lives of those trying to modernize government IT. In practice, the task is much more challenging. 

SSG has pursued the BIG picture. So BIG in fact, SSG is currently a somewhat unwieldy to work with. For example, most civic hackers are building web-based applications that follow a predictable pattern: web server + database + application logic. I'm not aware of an SSG profile that bundles all that up and removes the controls that make no sense for a web server. In fact, my experience with SSG so far is that SCAP content doesn't really model rationale of why of COURSE you wouldn't include X controls for a particular use case. Consequently, when you run SSG out of the box, you can get a lot of false positives for your use case. Here's another example: the current XCCDF report produced by OpenSCAP does not indicate at the summarily level the number of failed severity high issues. You'd have to either know which are high, or check every failing item to see if a high item failed. 


Greg Elin
personal cell: 917-304-3488
personal email: greg@fotonotes.net
email: gregelin@gitmachines.com







On Fri, Apr 18, 2014 at 4:32 PM, Shawn Wells <shawn@redhat.com> wrote:
On 4/18/14, 3:14 PM, Greg Elin wrote:
Greetings all --

I became involved with SCAP and SSG as part of grant from the Knight Foundation to support government innovation by creating tools and servers that meet government regulations, so that developers can easily build and adopt new technology. (More here: http://www.knightfoundation.org/grants/201345714/)

Basically, I want leverage SCAP so developers start with accreditation-ready environments and security is baked into the development process.

Right now, I am focusing on a "GovReady" toolkit so people can more easily add SCAP and vulnerability scanning into their projects; and a GovReady Clearinghouse of content to help people find ready versions of software.

I'm looking for a few volunteers to provide ongoing feedback on the prototypes we are building. 

Anyone interested in seeing early prototypes and providing feedback? We want to make the content easier for everyone to work with: Security folks, administrators, developers, even business side.

Thanks!

For those in the broader SSG community, I had the chance to speak with Greg awhile back. Some here may know him from his former life as the Chief Data Officer at the FCC. GitMachine's goals greatly align with SSG.

Greg, to perhaps provide some engagement, could you outline:
- How is your work different than Red Hat providing STIG'd and otherwise hardened (e.g. C2S) AMIs?
- How are your tools different than preexisting hardening scripts, which configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct and github.com/redhatgov)?
- What other components make a "GovReady" toolkit?
- To better understand how the SSG community could help, how does SSG fit into your work?

_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide