[PATCH][docs] editing the SSG workbook

Shawn Wells shawn at redhat.com
Thu Mar 6 00:39:35 UTC 2014


On 3/5/14, 4:17 PM, David Smith wrote:
> This patch set covers the following sections of the SSG workbook (docs/SCAP_and_STIG_Workshop):
>
> - Book Info
> - Introduction
> - The SCAP Security Guide
> - Understanding the Components
>
> Most of the changes are copy editing, but there is some content revision - making the prose more relevant in 2014, reflecting the current collection of profiles in the RHEL6 XCCDF, etc.  More patches to follow in the coming days.
>
>
> From 72d24530024dcb0f58fb5289a8ae180afd8e8298 Mon Sep 17 00:00:00 2001
> From: David Smith <dsmith at secure-innovations.net>
> Date: Wed, 5 Mar 2014 12:27:32 -0800
> Subject: [PATCH][docs] workbook editing - part 1
>
>
> Signed-off-by: David Smith <dsmith at secure-innovations.net>
> ---
>  docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml    |    2 +-
>  docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml |    2 +-
>  .../en-US/SCAP_Security_Guide_Project.xml          |   12 ++++++------
>  3 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml 
> b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> index 0d641bb..8d9bf98 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> @@ -5,7 +5,7 @@
>  ]>
>  <bookinfo 
> id="book-Documentation-SCAP_and_STIG_Workshop-SCAP_and_STIG_Workshop">
>      <title>SCAP and STIG Workshop</title>
> -    <subtitle>An introduction into using and customizing SCAP content 
> for Red Hat Enterprise Linux</subtitle>
> +    <subtitle>An introduction to using and customizing SCAP content 
> for Red Hat Enterprise Linux</subtitle>
>      <!-- <productname>SCAP Security Guide Project</productname>
>      <productnumber>1.0</productnumber> -->
>      <productname>SCAP Security Guide</productname>
> diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml 
> b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> index 4618a51..deb3e06 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> @@ -9,7 +9,7 @@
>      This workshop is intended to assist you in developing familiarity 
> with, and skill in, the installation and customization of SCAP content 
> for Red Hat Enterprise Linux, utilizing the DISA STIG baseline. Upon 
> completion of this workshop, you should be able to return to your 
> shop, obtain the SCAP components from Red Hat and DISA FSO, and be 
> able to perform highly automated STIG scanning and reporting.  Each 
> attendee will be given a virtual machine to use for this workshop. The 
> hostnames follow the syntax of:
>  <screen>studentX.scapworkshop.com</screen></para>
>      <para>
> -    The initial login will be studentX, with a password of 
> “password.” The root password is “redhat”.  This workshop has been 
> designed to be delivered over a two hour period, with each chapter 
> building upon the prior. Should you have any questions, please raise 
> your hand and the instructor(s) will be happy to assist.
> +    The initial login will be "studentX", with a password of 
> “password”. The root password is “redhat”.  This workshop has been 
> designed to be delivered over a two hour period, with each chapter 
> building upon the prior. Should you have any questions, please raise 
> your hand and the instructor(s) will be happy to assist.
>      </para>
>  </chapter>
>
> diff --git 
> a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml 
> b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> index 99f8740..40106b9 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> @@ -6,7 +6,7 @@
>  <chapter 
> id="chap-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project">
>      <title>SCAP Security Guide Project</title>
>      <para>
> -        The <firstterm>SCAP Security Guide</firstterm> (SSG) Project 
> delivers security guidance, baselines, and associated validation 
> mechanisms using the <firstterm>Security Content Automation 
> Protocol</firstterm> (SCAP). We currently provide content for 
> <firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6) and 
> <firstterm>JBoss Enterprise Application Server 5</firstterm> (JBoss 
> EAP5). Other technologies are planned, such as KVM and Red Hat 
> Storage, in CY2013.
> +        The <firstterm>SCAP Security Guide</firstterm> (SSG) Project 
> delivers security guidance, baselines, and associated validation 
> mechanisms using the <firstterm>Security Content Automation 
> Protocol</firstterm> (SCAP). We currently provide content for 
> <firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6), 
> <firstterm>Fedora</firstterm>, and <firstterm>JBoss Enterprise 
> Application Server 5</firstterm> (JBoss EAP5). Other technologies are 
> planned, such as KVM and Red Hat Storage, in CY2014.
>      </para>
>      <para>
>          The SSG project aspires to bridge the gap between generalized 
> policy and specific implementation guidance, in SCAP formats to 
> support automation whenever possible.
> @@ -17,23 +17,23 @@
>      <section 
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Background">
>          <title>Background</title>
>          <para>
> -            Security guidance documents, such as the NSA RHEL5 SNAC 
> Guide, have historically been authored in archaic static formats such 
> as PDF files. This left much to be desired, particularly around 
> automation, and individual shops were forced to create their own 
> scripted hardening processes. These processes were authored in their 
> own silos, by unique contractor teams, generally not shared across 
> programs, and caused gross waste of tax payer dollars. Additionally, 
> from a vendor perspective, supporting hardened environments was 
> commercially unfeasible. As each shop held it's own processes, how 
> could the vendor know what was changed and how to support it? The 
> system was broke.
> +            Security guidance documents, such as the NSA RHEL5 SNAC 
> Guide, have historically been authored in archaic and static formats 
> such as PDF files. This left much to be desired, particularly around 
> automation, and individual shops were forced to create their own 
> scripted hardening processes. These processes were authored in their 
> own silos, by unique contractor teams, generally not shared across 
> programs, and caused gross waste of taxpayer dollars. Additionally, 
> from a vendor perspective, supporting hardened environments was 
> commercially unfeasible. As each shop held its own processes, how 
> could the vendor know what was changed and how to support it? The 
> system was broken.
>          </para>
>          <para>
> -            In May 2011, the <firstterm>Information Assurance 
> Directorate of the National Security Agency</firstterm> (NSA IAD) 
> invited Red Hat to begin collaboration on high quality security 
> guidance for RHEL6. It was decided the content would be authored in 
> SCAP formats to support automation, and thus the SCAP Security Guide 
> project was born.
> +            In May 2011, the <firstterm>Information Assurance 
> Directorate of the National Security Agency</firstterm> (NSA IAD) 
> invited Red Hat to collaborate on the development of high quality 
> security guidance for RHEL6. It was decided the content would be 
> authored in SCAP formats to support automation, and thus the SCAP 
> Security Guide project was born.
>          </para>
>          <para>
> -            Development of security guidance continued through May 
> 2012, at which point Red Hat and NSA IAD contacted DISA Field Security 
> Operations (DISA FSO) to begin development of the Red Hat Enterprise 
> Linux 6 STIG. For the first time content development of a STIG would 
> be open sourced. The movement towards transparent collaboration – 
> between government agencies, industrial base partners, and content 
> consumers – further reflects acceptance by the NSA and DISA FSO of the 
> benefits of open source development models. On February 12th, 2013, 
> DISA FSO released the first public Draft RHEL6 STIG which was derived 
> from the upstream SCAP Security Guide project.
> +            Development of security guidance continued through May 
> 2012, at which point Red Hat and NSA IAD contacted DISA Field Security 
> Operations (DISA FSO) to begin development of the Red Hat Enterprise 
> Linux 6 STIG. For the first time content development of a STIG would 
> be open sourced. This movement towards transparent collaboration – 
> between government agencies, industrial base partners, and content 
> consumers – further reflects acceptance by the NSA and DISA FSO of the 
> benefits of open source development models. On February 12th, 2013, 
> DISA FSO released the Draft RHEL6 STIG -- derived from the upstream 
> SCAP Security Guide project.
>          </para>
>          <para>
> -            This community powered innovation model has allowed the 
> rapid creation of security baselines at dramatically reduced costs, 
> shortened timeframes, and (arguably) has produced higher-quality 
> content that has now become official U.S. Government standards.
> +            This community driven innovation model has allowed the 
> rapid creation of security baselines at dramatically reduced costs, 
> shortened timeframes, and has produced higher-quality content that has 
> produced official U.S. Government baselines and standards.
>          </para>
>      </section>
>
>      <section 
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Project_Charter">
>          <title>Project Charter</title>
>          <para>
> -            The SSG community has a single goal: Develop usable 
> security baselines across all Red Hat technology areas. Patches welcome!
> +            The SSG community has a single goal: developing usable 
> security baselines across all Red Hat technology areas. Patches are 
> welcome!
>          </para>
>      </section>
>      <section 
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Installation">
> -- 
> 1.7.1
>


> From 485ff3ec2ce0128430310c3d15c1cd05ca718f53 Mon Sep 17 00:00:00 2001
> From: David Smith <dsmith at secure-innovations.net>
> Date: Wed, 5 Mar 2014 12:51:30 -0800
> Subject: [PATCH][docs] workbook editing - part 2
>
>
> Signed-off-by: David Smith <dsmith at secure-innovations.net>
> ---
>  .../en-US/Understanding_the_Components.xml         |   21 
> ++++++++++---------
>  1 files changed, 11 insertions(+), 10 deletions(-)
>
> diff --git 
> a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml 
> b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> index e1e7369..94d0f57 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> @@ -50,7 +50,7 @@
>          <title>OpenSCAP</title>
>          <para>The SCAP protocol suite contains multiple complex data 
> exchange formats that are used to transmit important vulnerability, 
> configuration, and other security data. Historically there have been 
> few tools that provide a way to query this data in the needed format. 
> This lack of tools makes the barrier to entry very high and 
> discourages adoption of these protocols by the community. It's the 
> goal of the OpenSCAP project to create a framework of libraries and 
> tools to improve the accessibility of SCAP
>  and enhance the usability of the information it presents.</para>
> -        <para>SCAP is a protocol, akin to HTML, and consumers must 
> use a protocol interpreter. OpenSCAP provides that functionality for 
> the RHEL platform.</para>
> +        <para>SCAP is a protocol, akin to HTML, and consumers must 
> use a protocol interpreter. OpenSCAP provides that functionality for 
> Red Hat platforms.</para>
>          <para>The OpenSCAP homepage can be found at <ulink 
> url="http://www.open-scap.org/page/Main_Page" /></para>
>      </section>
>      <section 
> id="sect-Documentation-SCAP_and_STIG_Workshop-Understanding_the_components-XCCDF">
> @@ -145,20 +145,21 @@ and enhance the usability of the information it 
> presents.</para>
>              <para>XCCDF rules are logically organized into profiles. 
> To query which profiles are contained within the SCAP Security Guide 
> project, run the following command:
>                  <screen>
>  $ grep -n "&#60;Profile" 
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> -12: &#60;Profile id="test"&#62;
> -68: &#60;Profile id="common"&#62;
> -345: &#60;Profile id="desktop" extends="common"&#62;
> -381: &#60;Profile id="server" extends="common"&#62;
> -389: &#60;Profile id="ftp" extends="server"&#62;
> -403: &#60;Profile id="stig-rhel6-server" extends="common"&#62;
> +40: &#60;Profile id="test"&#62;
> +67: &#60;Profile id="CS2"&#62;
> +398: &#60;Profile id="common"&#62;
> +613: &#60;Profile id="server"&#62;
> +832: &#60;Profile id="stig-rhel6-server"&#62;
> +1101: &#60;Profile id="usgcb-rhel6-server"&#62;
> +1360: &#60;Profile id="rht-ccp"&#62;
>                  </screen>
>              </para>
> -            <para>If you were to view line 403 and those proceeding, 
> you will see a sampling of which rules make up the stig-rhel6-server 
> profile:
> +<!--            <para>If you were to view line 403 and those 
> proceeding, you will see a sampling of which rules make up the 
> stig-rhel6-server profile:
>                  <screen>
>  $ sed -n '403,413p' /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
>  &#60;Profile id="stig-rhel6-server" extends="common"&#62;
>  &#60;title&#62;Pre-release Draft STIG for RHEL 6 Server&#60;/title&#62;
> -&#60;description&#62;This profile is being developed under the DoD 
> consensus
> +&#60;description&#62;This profile is being developed under the DoD 
> consensusi
>  model to become a STIG in coordination with DISA 
> FSO.&#60;/description&#62;
>  &#60;select idref="encrypt_partitions" selected="true"/&#62;
>  &#60;select idref="rpm_verify_permissions" selected="true"/&#62;
> @@ -169,7 +170,7 @@ model to become a STIG in coordination with DISA 
> FSO.&#60;/description&#62;
>  &#60;select idref="disable_ctrlaltdel_reboot" selected="true"/&#62;
>  &#60;select idref="service_postfix_enable" selected="true"/&#62;
>                  </screen>
> -            </para>
> +            </para> -->
>          </section>
>      </section>
>  </chapter>
> -- 
> 1.7.1
>

ack & thanks!


More information about the scap-security-guide mailing list