scap-security-guide: building SCAP content for RHEL 6

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Sep 28 22:11:56 UTC 2011


Aqueduct list,

I wanted to bring to your attention a new project on fedorahosted:
https://fedorahosted.org/scap-security-guide

It is designed to provide security guidance and checking content in the 
SCAP formats.  Specifically, the project goal is to produce --- from a 
single body of content:

1) an informative prose guide, similar in style to NSA's RHEL 5 guide
2) a desktop settings baseline, similar in style to NIST USGCB
3) a server settings baseline,  similar in style to a STIG
4) additional baselines for other network roles (such as LAMP server)
5) a body of automated checking content in the OVAL format

Currently, we are engaged in updating NIST's beta USGCB content for RHEL 
5 Desktop to RHEL 6.  We continue to evolve simple scripts for creating 
and manipulating such content in an agile fashion.

A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov):
To grossly simplify, consider it a set of XML schema that describe 
configuration checklists/guides, and also how to carry out checks for 
compliance (and patching).  Content expressed in the SCAP formats can be 
very verbose/ugly, but there is a significant benefit in that a growing 
body of commercially available tools can ingest SCAP content and provide 
results in standardized formats.  For the enterprise, this is very 
significant.

The OpenSCAP project provides a very important automation/testing and 
presentation capabilities for such content, and we use it for guide 
generation and unit testing of checks.  The scap-workbench project 
allows for easy editing and tailoring of such content (for end-users).

When fully developed, we intend to endorse the prose and associated 
checking content developed on scap-security-guide as best practice 
guidance.  As Aqueduct provides deployment resources for compliance with 
security baselines from multiple organizations, we would like to 
maintain close coordination.

We welcome your participation, particularly if you have information that 
you believe represents security best practice for RHEL 6.  If you are 
familiar with SCAP formats and would like to participate directly in the 
creation of XCCDF, OVAL or OCIL content, such expertise is particularly 
valued.

Please feel free to send questions to the mailing list at
scap-security-guide at lists.fedorahosted.org , or directly to me.

Thanks,
Jeff


___________________________
Jeffrey Blank
410-854-8675
Global Mitigations
NSA Information Assurance

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 11480 bytes
Desc: S/MIME Cryptographic Signature
Url : https://fedorahosted.org/pipermail/scap-security-guide/attachments/20110928/0c9baaf9/attachment-0001.bin 


More information about the scap-security-guide mailing list