Hi Tim,
This is a completely unofficial (and quite possibly non-helpful) response
as I am primarily a user of OpenSCAP, not a developer nor do I work for
NIST or any government agency for that matter.
But I run Arch locally on my desktop as do most of my infrastructure team
members so this caught my eye. And I run OpenSCAP scans on RHEL/7.3
instances that we support.
The STIG for RHEL/7 has just recently been NIST certified which means
stamped with their approval for use on government systems. There is no
(certified) STIG for Debian, Arch, Ubuntu, etc.
In my opinion, this reflects a larger issue - a peeve of mine: While the
government (in particular, the DHS which is driving the Continuous
Diagnostics and Monitoring (CDM) process) is beginning to realize that
static stamps of security (in particular, the FISMA/ATO which runs on a
three-year cycle) no longer matches the fluid security threat landscape,
they are not willing to embrace the major paradigm shift of rolling
releases as found in Arch. The hesitancy is based in good intentions: if
you exhaustively examine a system for security threats and stamp it SECURE
then any changes to it could introduce new bugs/security holes.
But of course, new bugs/security holes are constantly being discovered in
Windows 7, etc. Meanwhile, as new threat vectors are discovered, new system
architectures evolve to remediate or completely disallow/disable the new
threat, and these are available in new releases. If a bug is found, it is
immediately patched. (I love Arch.)
The STIGs still serve a good purpose, as they enable system specific
scanning of a large number of controls - I believe it has helped me ensure
greater security of my RHEL/7 systems. But the snails pace of NIST
certification and the inability to consider other operating systems and
applications seems to be based in the goal of static security management.
Well, that was quite a ramble, but I will stop before I go on. You might
also want to check out work that 18F did on securing Ubuntu 14.04 a couple
years ago, see:
https://github.com/fisma-ready/ubuntu-lts
And I am working toward proposing some initial steps toward greater
flexibility, but they are not ready for publication yet. I'll drop a note
here when they are.
Good luck with your Arch system. (And maybe someone else may have
something more helpful to contribute.)
=Fen
On Mon, Apr 17, 2017 at 1:42 PM, <bradt(a)signatureresearchinc.com> wrote:
Hello,
My name is Tim Bradt. I am software developer at Signature Research, Inc.
I have been charged with getting SCAP up and running on some of our systems.
We are running Arch Linux. I was wondering what the process would be for
porting the RHEL7 guide to Arch as we need the DISA STIG for system
approval.
Thanks for your help,
Tim
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.
fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@
lists.fedorahosted.org