On 3/5/14, 4:17 PM, David Smith wrote:
This patch set covers the following sections of the SSG workbook
(docs/SCAP_and_STIG_Workshop):
- Book Info
- Introduction
- The SCAP Security Guide
- Understanding the Components
Most of the changes are copy editing, but there is some content revision - making the
prose more relevant in 2014, reflecting the current collection of profiles in the RHEL6
XCCDF, etc. More patches to follow in the coming days.
From 72d24530024dcb0f58fb5289a8ae180afd8e8298 Mon Sep 17 00:00:00 2001
From: David Smith <dsmith(a)secure-innovations.net>
Date: Wed, 5 Mar 2014 12:27:32 -0800
Subject: [PATCH][docs] workbook editing - part 1
Signed-off-by: David Smith <dsmith(a)secure-innovations.net>
---
docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml | 2 +-
docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml | 2 +-
.../en-US/SCAP_Security_Guide_Project.xml | 12 ++++++------
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
index 0d641bb..8d9bf98 100644
--- a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
+++ b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
@@ -5,7 +5,7 @@
]>
<bookinfo
id="book-Documentation-SCAP_and_STIG_Workshop-SCAP_and_STIG_Workshop">
<title>SCAP and STIG Workshop</title>
- <subtitle>An introduction into using and customizing SCAP content
for Red Hat Enterprise Linux</subtitle>
+ <subtitle>An introduction to using and customizing SCAP content
for Red Hat Enterprise Linux</subtitle>
<!-- <productname>SCAP Security Guide Project</productname>
<productnumber>1.0</productnumber> -->
<productname>SCAP Security Guide</productname>
diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
index 4618a51..deb3e06 100644
--- a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
+++ b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
@@ -9,7 +9,7 @@
This workshop is intended to assist you in developing familiarity
with, and skill in, the installation and customization of SCAP content
for Red Hat Enterprise Linux, utilizing the DISA STIG baseline. Upon
completion of this workshop, you should be able to return to your
shop, obtain the SCAP components from Red Hat and DISA FSO, and be
able to perform highly automated STIG scanning and reporting. Each
attendee will be given a virtual machine to use for this workshop. The
hostnames follow the syntax of:
<screen>studentX.scapworkshop.com</screen></para>
<para>
- The initial login will be studentX, with a password of
“password.” The root password is “redhat”. This workshop has been
designed to be delivered over a two hour period, with each chapter
building upon the prior. Should you have any questions, please raise
your hand and the instructor(s) will be happy to assist.
+ The initial login will be "studentX", with a password of
“password”. The root password is “redhat”. This workshop has been
designed to be delivered over a two hour period, with each chapter
building upon the prior. Should you have any questions, please raise
your hand and the instructor(s) will be happy to assist.
</para>
</chapter>
diff --git
a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
index 99f8740..40106b9 100644
--- a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
+++ b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
@@ -6,7 +6,7 @@
<chapter
id="chap-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project">
<title>SCAP Security Guide Project</title>
<para>
- The <firstterm>SCAP Security Guide</firstterm> (SSG) Project
delivers security guidance, baselines, and associated validation
mechanisms using the <firstterm>Security Content Automation
Protocol</firstterm> (SCAP). We currently provide content for
<firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6) and
<firstterm>JBoss Enterprise Application Server 5</firstterm> (JBoss
EAP5). Other technologies are planned, such as KVM and Red Hat
Storage, in CY2013.
+ The <firstterm>SCAP Security Guide</firstterm> (SSG) Project
delivers security guidance, baselines, and associated validation
mechanisms using the <firstterm>Security Content Automation
Protocol</firstterm> (SCAP). We currently provide content for
<firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6),
<firstterm>Fedora</firstterm>, and <firstterm>JBoss Enterprise
Application Server 5</firstterm> (JBoss EAP5). Other technologies are
planned, such as KVM and Red Hat Storage, in CY2014.
</para>
<para>
The SSG project aspires to bridge the gap between generalized
policy and specific implementation guidance, in SCAP formats to
support automation whenever possible.
@@ -17,23 +17,23 @@
<section
id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Background">
<title>Background</title>
<para>
- Security guidance documents, such as the NSA RHEL5 SNAC
Guide, have historically been authored in archaic static formats such
as PDF files. This left much to be desired, particularly around
automation, and individual shops were forced to create their own
scripted hardening processes. These processes were authored in their
own silos, by unique contractor teams, generally not shared across
programs, and caused gross waste of tax payer dollars. Additionally,
from a vendor perspective, supporting hardened environments was
commercially unfeasible. As each shop held it's own processes, how
could the vendor know what was changed and how to support it? The
system was broke.
+ Security guidance documents, such as the NSA RHEL5 SNAC
Guide, have historically been authored in archaic and static formats
such as PDF files. This left much to be desired, particularly around
automation, and individual shops were forced to create their own
scripted hardening processes. These processes were authored in their
own silos, by unique contractor teams, generally not shared across
programs, and caused gross waste of taxpayer dollars. Additionally,
from a vendor perspective, supporting hardened environments was
commercially unfeasible. As each shop held its own processes, how
could the vendor know what was changed and how to support it? The
system was broken.
</para>
<para>
- In May 2011, the <firstterm>Information Assurance
Directorate of the National Security Agency</firstterm> (NSA IAD)
invited Red Hat to begin collaboration on high quality security
guidance for RHEL6. It was decided the content would be authored in
SCAP formats to support automation, and thus the SCAP Security Guide
project was born.
+ In May 2011, the <firstterm>Information Assurance
Directorate of the National Security Agency</firstterm> (NSA IAD)
invited Red Hat to collaborate on the development of high quality
security guidance for RHEL6. It was decided the content would be
authored in SCAP formats to support automation, and thus the SCAP
Security Guide project was born.
</para>
<para>
- Development of security guidance continued through May
2012, at which point Red Hat and NSA IAD contacted DISA Field Security
Operations (DISA FSO) to begin development of the Red Hat Enterprise
Linux 6 STIG. For the first time content development of a STIG would
be open sourced. The movement towards transparent collaboration –
between government agencies, industrial base partners, and content
consumers – further reflects acceptance by the NSA and DISA FSO of the
benefits of open source development models. On February 12th, 2013,
DISA FSO released the first public Draft RHEL6 STIG which was derived
from the upstream SCAP Security Guide project.
+ Development of security guidance continued through May
2012, at which point Red Hat and NSA IAD contacted DISA Field Security
Operations (DISA FSO) to begin development of the Red Hat Enterprise
Linux 6 STIG. For the first time content development of a STIG would
be open sourced. This movement towards transparent collaboration –
between government agencies, industrial base partners, and content
consumers – further reflects acceptance by the NSA and DISA FSO of the
benefits of open source development models. On February 12th, 2013,
DISA FSO released the Draft RHEL6 STIG -- derived from the upstream
SCAP Security Guide project.
</para>
<para>
- This community powered innovation model has allowed the
rapid creation of security baselines at dramatically reduced costs,
shortened timeframes, and (arguably) has produced higher-quality
content that has now become official U.S. Government standards.
+ This community driven innovation model has allowed the
rapid creation of security baselines at dramatically reduced costs,
shortened timeframes, and has produced higher-quality content that has
produced official U.S. Government baselines and standards.
</para>
</section>
<section
id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Project_Charter">
<title>Project Charter</title>
<para>
- The SSG community has a single goal: Develop usable
security baselines across all Red Hat technology areas. Patches welcome!
+ The SSG community has a single goal: developing usable
security baselines across all Red Hat technology areas. Patches are
welcome!
</para>
</section>
<section
id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Installation">
--
1.7.1
From 485ff3ec2ce0128430310c3d15c1cd05ca718f53 Mon Sep 17 00:00:00
2001
From: David Smith <dsmith(a)secure-innovations.net>
Date: Wed, 5 Mar 2014 12:51:30 -0800
Subject: [PATCH][docs] workbook editing - part 2
Signed-off-by: David Smith <dsmith(a)secure-innovations.net>
---
.../en-US/Understanding_the_Components.xml | 21
++++++++++---------
1 files changed, 11 insertions(+), 10 deletions(-)
diff --git
a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
index e1e7369..94d0f57 100644
--- a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
+++ b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
@@ -50,7 +50,7 @@
<title>OpenSCAP</title>
<para>The SCAP protocol suite contains multiple complex data
exchange formats that are used to transmit important vulnerability,
configuration, and other security data. Historically there have been
few tools that provide a way to query this data in the needed format.
This lack of tools makes the barrier to entry very high and
discourages adoption of these protocols by the community. It's the
goal of the OpenSCAP project to create a framework of libraries and
tools to improve the accessibility of SCAP
and enhance the usability of the information it presents.</para>
- <para>SCAP is a protocol, akin to HTML, and consumers must
use a protocol interpreter. OpenSCAP provides that functionality for
the RHEL platform.</para>
+ <para>SCAP is a protocol, akin to HTML, and consumers must
use a protocol interpreter. OpenSCAP provides that functionality for
Red Hat platforms.</para>
<para>The OpenSCAP homepage can be found at <ulink
url="http://www.open-scap.org/page/Main_Page" /></para>
</section>
<section
id="sect-Documentation-SCAP_and_STIG_Workshop-Understanding_the_components-XCCDF">
@@ -145,20 +145,21 @@ and enhance the usability of the information it
presents.</para>
<para>XCCDF rules are logically organized into profiles.
To query which profiles are contained within the SCAP Security Guide
project, run the following command:
<screen>
$ grep -n "<Profile"
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
-12: <Profile id="test">
-68: <Profile id="common">
-345: <Profile id="desktop" extends="common">
-381: <Profile id="server" extends="common">
-389: <Profile id="ftp" extends="server">
-403: <Profile id="stig-rhel6-server"
extends="common">
+40: <Profile id="test">
+67: <Profile id="CS2">
+398: <Profile id="common">
+613: <Profile id="server">
+832: <Profile id="stig-rhel6-server">
+1101: <Profile id="usgcb-rhel6-server">
+1360: <Profile id="rht-ccp">
</screen>
</para>
- <para>If you were to view line 403 and those proceeding,
you will see a sampling of which rules make up the stig-rhel6-server
profile:
+<!-- <para>If you were to view line 403 and those
proceeding, you will see a sampling of which rules make up the
stig-rhel6-server profile:
<screen>
$ sed -n '403,413p' /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
<Profile id="stig-rhel6-server" extends="common">
<title>Pre-release Draft STIG for RHEL 6 Server</title>
-<description>This profile is being developed under the DoD
consensus
+<description>This profile is being developed under the DoD
consensusi
model to become a STIG in coordination with DISA
FSO.</description>
<select idref="encrypt_partitions"
selected="true"/>
<select idref="rpm_verify_permissions"
selected="true"/>
@@ -169,7 +170,7 @@ model to become a STIG in coordination with DISA
FSO.</description>
<select idref="disable_ctrlaltdel_reboot"
selected="true"/>
<select idref="service_postfix_enable"
selected="true"/>
</screen>
- </para>
+ </para> -->
</section>
</section>
</chapter>
--
1.7.1
ack & thanks!