Thanks for you notes, Steve.
Here is the use case driving my question for OpenSCAP on OS X. I'm not really trying to lock down the entire Mac, it's more that I am trying to just recognize the developer is on a Mac. Suggestions appreciated!
Use case background:
I'm working on GovReady, a toolkit to make security assessments for FISMA purposes easier. My target audience or IT shops understaffed in security and always have a backlog. The idea is to create leverage openSCAP and SSG to create a more automated and user-friendly process to gain shared awareness of the certification-worthiness of a system.
Use case:
Bob is a FISMA-naive needs to be more aware of the security of the app/system they are building. Janice is a IT administrator who needs to check how secure an open source Bob's app is but doesn't have a lot of time. Bob and Janice go to GovReady.org and download the toolkit, installing it in the app in question. Kind of like adding jQuery. They just download GovReady and unzip it into a directory. Next they type a simple line command, `govready install` and everything gets installed. Then they type `govready assess` (or `govready scan`) and some canned-tests (e.g. profiles) are run and beautiful reports generated. GovReady provides a kind of beginner wrapper around the underlying tools.
If Bob and Janice are CentOS/RHEL (or using a Vagrant VM running Linux), this is pretty easy. But many FISMA-naive developers in DC these days are on OS X or even Windows. So I'm trying to understand how I can create a simple install process that works cross-platform. The cross-platform install at BEST would install the appropriate open source scanning tool for the platform. If that is too hard right now, then at least the install process should fail gracefully and encourage the individual to use virtual machines.
Greg Elin
personal cell: 917-304-3488