Thanks for those questions. My response tl;dr.
- How is your work different than Red Hat providing STIG'd and otherwise
hardened (e.g. C2S) AMIs?
A. Great minds think a like! The idea for accreditation-ready virtual
machines was pitched in Spring 2013 when nobody (that I knew) was providing
STIG'd and hardened AMIs.The guidance was there, but you the VMs were not.
A correctly configured OS is 80%+ of the battle. Once the OS is handled,
there is still (a) producing configurations for the application stack and
(b) producing the required FISMA paperwork artifacts. I think the other
difference is being able to move pre-configured, pre-hardened
architectures. The final difference is improving the UI of the scans and
tools.
- How are your tools different than preexisting hardening scripts, which
configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct and
github.com/redhatgov)?
A. The biggest difference was to combine these existing hardening scripts
with the DevOps orchestration software (e.g., Puppet, Chef, Ansible), in
order to create one-click, build, install, scan, generate paperwork
systems. The existing tools are not currently found as part of Bitname
downloadable stacks for example. Also, most of the scripts are focused just
on the OS. But if your are going to be using Wordpress you have to deal
with Linux, Apache, Mysql, PHP, Wordpress, and possibly Wordpress plugins.
From what I can tell most of the SCAP content stops at OS. We have
STIG
material for Apache and Wordpress, but it seems narrative and not SCAP.
- What other components make a "GovReady" toolkit?
A. Let describe use case first, then components. On May 31, thousands of
"civic hackers" will gather for the National Day of Civic Hacking. That's
on top of the hundreds of thousands of civic hackers participating in open
government challenges and events around the world (plus commercial
companies). Because these civic hackers have no experience with FISMA or
STIGs or SCAP, it is rare their work can ever be used by government. But we
can use SCAP and SSG and DevOps to change that. In this use case, GovReady
packages up SCAP and an open source vulnerability scanner like RATS or
openVAS (eager for suggestions) to provide civic hackers with a basic but
powerful DIY vulnerability assessment tool. A civic hacker who wants to use
NodeJS visits
GovReady.org to find the version of NodeJS government is
using and a virtual machine (or link to AMI) that is already properly
STIG'd. GovReady is included, too, Now the user can easily produce an XCCDF
that demonstrates the application is mostly or completely hardened.
- To better understand how the SSG community could help, how does SSG fit
into your work?
A. The SCAP Security Guide is essential! It's the entire base!
Cybersecurity cannot be left to contractors, or expensive enterprise
products. For everyone to be in compliance, compliance has to be openly and
automatically available to everyone. More than anything I hoped that I
could use SSG and Aquaduct to make it a snap to give people
accreditation-ready virtual machines; that I would just need to mashup a
few existing projects to change the lives of those trying to modernize
government IT. In practice, the task is much more challenging.
SSG has pursued the BIG picture. So BIG in fact, SSG is currently a
somewhat unwieldy to work with. For example, most civic hackers are
building web-based applications that follow a predictable pattern: web
server + database + application logic. I'm not aware of an SSG profile that
bundles all that up and removes the controls that make no sense for a web
server. In fact, my experience with SSG so far is that SCAP content doesn't
really model rationale of why of COURSE you wouldn't include X controls for
a particular use case. Consequently, when you run SSG out of the box, you
can get a lot of false positives for your use case. Here's another example:
the current XCCDF report produced by OpenSCAP does not indicate at the
summarily level the number of failed severity high issues. You'd have to
either know which are high, or check every failing item to see if a high
item failed.
Greg Elin
personal cell: 917-304-3488
personal email: greg(a)fotonotes.net
email: gregelin(a)gitmachines.com
On Fri, Apr 18, 2014 at 4:32 PM, Shawn Wells <shawn(a)redhat.com> wrote:
On 4/18/14, 3:14 PM, Greg Elin wrote:
Greetings all --
I became involved with SCAP and SSG as part of grant from the Knight
Foundation to support government innovation by creating tools and servers
that meet government regulations, so that developers can easily build and
adopt new technology. (More here:
http://www.knightfoundation.org/grants/201345714/)
Basically, I want leverage SCAP so developers start with
accreditation-ready environments and security is baked into the development
process.
Right now, I am focusing on a "GovReady" toolkit so people can more
easily add SCAP and vulnerability scanning into their projects; and a
GovReady Clearinghouse of content to help people find ready versions of
software.
*I'm looking for a few volunteers to provide ongoing feedback on the
prototypes we are building. *
*Anyone interested in seeing early prototypes and providing feedback?*We want to make
the content easier for everyone to work with: Security
folks, administrators, developers, even business side.
Thanks!
For those in the broader SSG community, I had the chance to speak with
Greg awhile back. Some here may know him from his former life as the Chief
Data Officer at the FCC. GitMachine's goals greatly align with SSG.
Greg, to perhaps provide some engagement, could you outline:
- How is your work different than Red Hat providing STIG'd and otherwise
hardened (e.g. C2S) AMIs?
- How are your tools different than preexisting hardening scripts, which
configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct and
github.com/redhatgov)?
- What other components make a "GovReady" toolkit?
- To better understand how the SSG community could help, how does SSG fit
into your work?
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide