Understanding Content

Shawn Wells shawn at redhat.com
Thu Dec 12 02:10:25 UTC 2013


On 12/11/13, 6:47 PM, joescap at mm.st wrote:
> Thank you, that does help, but a few followup questions.  In the SCAP
> content on thehttps://fedorahosted.org/scap-security-guide/  there are
> several profiles in the ssg-rhel6-xccdf.xml:
> server, stig-rhel6-server, usgcb-rhel6-server
>
> I'm trying to understand if these are profiles that have been submitted
> to NIST or DISA and are waiting for approval? Are these the accepted
> baselines for a RH Server at this point? Should I use the usgcb or stig
> profile?   Just trying to wrap my head around this since we want to
> start using one of these.

In regards to formal government baselines, the SSG community 
collaborates with the government and often acts as upstream. We work 
very closely with DISA FSO on the STIG; however, to be very clear, SSG 
serves as the /upstream/ for content development. The official baselines 
are /always/ posted by the relevant agency (e.g. @ 
http://iase.disa.mil/stigs/os/unix/red_hat.html). As bugs are reported 
against the DISA FSO STIG, we aspire to fix them within SSG, and those 
changes will be picked up during the next DISA FSO code rebase.

You can read some background of the STIG process here, though note it's 
a personal blog and not 'official' of SSG/RedHat/the gov:
http://blog-shawndwells.rhcloud.com/dont-miss-the-point-of-the-rhel6-stig/


> In your statement below "The DISA STIG content is based on the SCAP
> Security Guide (SSG) content." Does that mean that the Content on the
> https://fedorahosted.org/scap-security-guide/  was used by DISA to create
> the Standalone XCCDF - RedHat 6 STIG, Version 1, Release 2"?

Yes. We (RedHat/DISA/NSA) derived the official RHEL6 STIG from the SCAP 
Security Guide project. Every so often DISA FSO aspires to rebase the 
STIG from SSG.

The RHEL6 STIG still followed the same development process: there was a 
DoD Consensus meeting (which involved representatives from the various 
DoD elements), formal signoff by the NSA, acceptance from DoD CIO, etc. 
Instead of developing the RHEL6 STIG in a closed fashion, we wanted to 
open source the entire process. As such, SSG was born.

> Obviously new to this and trying to understand.  Thanks
Welcome!

SSG is best known as the upstream for the RHEL6 STIG, however SSG really 
represents a large body of individual security controls. These controls 
can be logically grouped into profiles -- such as common, STIG, or USGCB 
-- and are not specific to government. Collaboration on commercial 
standards, such as PCI, would be most welcome.

-- 
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131211/c53a805c/attachment.html>


More information about the scap-security-guide mailing list