On 7/17/15 12:48 PM, Jaffa, Scott J wrote:
Mike,
I see SIMP as broader than the SSG ecosystem, and also complementary.
SIMP gives the ability to define full end state configuration for
systems which includes security configuration. It fulfils the ops
desire to have all configuration go through a single path by combining
the security configuration with the system configuration.
SSG provides a validation capability, allowing both ops and security
to know and track system state from a security view, and document
deviations (SCAPtimony). SSG also provides a quick ability to meet a
security baseline, for example on initial server build, before full
configuration has been applied.
As an aside, Trevor has mostly convinced me that my team should focus
our future Puppet module work against SIMP.
Well put. SSG serves as the scanning engine (like Paul Arnold called
out). As a project, SIMP is much larger -- configuration management via
Puppet, virus scanning, etc.
For details on how SIMP is using OpenSCAP+SSG, check out Trevor
Vaughan's "Distributed OpenSCAP Compliance Validation with MCollective"
presentation on our Content+Collateral page:
https://github.com/OpenSCAP/scap-security-guide/wiki/Collateral-and-Refer...