Seeking feedback on GovReady - tools for government-ready configurations of software

Shawn Wells shawn at redhat.com
Fri Apr 18 20:32:17 UTC 2014


On 4/18/14, 3:14 PM, Greg Elin wrote:
> Greetings all --
>
> I became involved with SCAP and SSG as part of grant from the Knight 
> Foundation to support government innovation by creating tools and 
> servers that meet government regulations, so that developers can 
> easily build and adopt new technology. (More here: 
> http://www.knightfoundation.org/grants/201345714/)
>
> Basically, I want leverage SCAP so developers start with 
> accreditation-ready environments and security is baked into the 
> development process.
>
> Right now, I am focusing on a "GovReady" toolkit so people can more 
> easily add SCAP and vulnerability scanning into their projects; and a 
> GovReady Clearinghouse of content to help people find ready versions 
> of software.
>
> *I'm looking for a few volunteers to provide ongoing feedback on the 
> prototypes we are building. *
> *
> *
> *Anyone interested in seeing early prototypes and providing feedback?* 
> We want to make the content easier for everyone to work with: Security 
> folks, administrators, developers, even business side.
>
> Thanks!

For those in the broader SSG community, I had the chance to speak with 
Greg awhile back. Some here may know him from his former life as the 
Chief Data Officer at the FCC. GitMachine's goals greatly align with SSG.

Greg, to perhaps provide some engagement, could you outline:
- How is your work different than Red Hat providing STIG'd and otherwise 
hardened (e.g. C2S) AMIs?
- How are your tools different than preexisting hardening scripts, which 
configure machines to STIG, FISMA, and other baselines (e.g. Aqueduct 
and github.com/redhatgov)?
- What other components make a "GovReady" toolkit?
- To better understand how the SSG community could help, how does SSG 
fit into your work?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140418/391ae504/attachment.html>


More information about the scap-security-guide mailing list