On 7/17/15 12:48 PM, Jaffa, Scott J wrote:

Mike,

 

I see SIMP as broader than the SSG ecosystem, and also complementary.

SIMP gives the ability to define full end state configuration for systems which includes security configuration.  It fulfils the ops desire to have all configuration go through a single path by combining the security configuration with the system configuration.

SSG provides a validation capability, allowing both ops and security to know and track system state from a security view, and document deviations (SCAPtimony).  SSG also provides a quick ability to meet a security baseline, for example on initial server build, before full configuration has been applied. 

As an aside, Trevor has mostly convinced me that my team should focus our future Puppet module work against SIMP. 


Well put. SSG serves as the scanning engine (like Paul Arnold called out). As a project, SIMP is much larger -- configuration management via Puppet, virus scanning, etc.

For details on how SIMP is using OpenSCAP+SSG, check out Trevor Vaughan's "Distributed OpenSCAP Compliance Validation with MCollective" presentation on our Content+Collateral page:

https://github.com/OpenSCAP/scap-security-guide/wiki/Collateral-and-References