Aqueduct list,
I wanted to bring to your attention a new project on fedorahosted:
https://fedorahosted.org/scap-security-guide
It is designed to provide security guidance and checking content in the
SCAP formats. Specifically, the project goal is to produce --- from a
single body of content:
1) an informative prose guide, similar in style to NSA's RHEL 5 guide
2) a desktop settings baseline, similar in style to NIST USGCB
3) a server settings baseline, similar in style to a STIG
4) additional baselines for other network roles (such as LAMP server)
5) a body of automated checking content in the OVAL format
Currently, we are engaged in updating NIST's beta USGCB content for RHEL
5 Desktop to RHEL 6. We continue to evolve simple scripts for creating
and manipulating such content in an agile fashion.
A quick primer on SCAP (
scap.nist.gov and
usgcb.nist.gov):
To grossly simplify, consider it a set of XML schema that describe
configuration checklists/guides, and also how to carry out checks for
compliance (and patching). Content expressed in the SCAP formats can be
very verbose/ugly, but there is a significant benefit in that a growing
body of commercially available tools can ingest SCAP content and provide
results in standardized formats. For the enterprise, this is very
significant.
The OpenSCAP project provides a very important automation/testing and
presentation capabilities for such content, and we use it for guide
generation and unit testing of checks. The scap-workbench project
allows for easy editing and tailoring of such content (for end-users).
When fully developed, we intend to endorse the prose and associated
checking content developed on scap-security-guide as best practice
guidance. As Aqueduct provides deployment resources for compliance with
security baselines from multiple organizations, we would like to
maintain close coordination.
We welcome your participation, particularly if you have information that
you believe represents security best practice for RHEL 6. If you are
familiar with SCAP formats and would like to participate directly in the
creation of XCCDF, OVAL or OCIL content, such expertise is particularly
valued.
Please feel free to send questions to the mailing list at
scap-security-guide(a)lists.fedorahosted.org , or directly to me.
Thanks,
Jeff
___________________________
Jeffrey Blank
410-854-8675
Global Mitigations
NSA Information Assurance