[PATCH][docs] editing the SSG workbook
Shawn Wells
shawn at redhat.com
Thu Mar 6 00:39:35 UTC 2014
On 3/5/14, 4:17 PM, David Smith wrote:
> This patch set covers the following sections of the SSG workbook (docs/SCAP_and_STIG_Workshop):
>
> - Book Info
> - Introduction
> - The SCAP Security Guide
> - Understanding the Components
>
> Most of the changes are copy editing, but there is some content revision - making the prose more relevant in 2014, reflecting the current collection of profiles in the RHEL6 XCCDF, etc. More patches to follow in the coming days.
>
>
> From 72d24530024dcb0f58fb5289a8ae180afd8e8298 Mon Sep 17 00:00:00 2001
> From: David Smith <dsmith at secure-innovations.net>
> Date: Wed, 5 Mar 2014 12:27:32 -0800
> Subject: [PATCH][docs] workbook editing - part 1
>
>
> Signed-off-by: David Smith <dsmith at secure-innovations.net>
> ---
> docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml | 2 +-
> docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml | 2 +-
> .../en-US/SCAP_Security_Guide_Project.xml | 12 ++++++------
> 3 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> index 0d641bb..8d9bf98 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Book_Info.xml
> @@ -5,7 +5,7 @@
> ]>
> <bookinfo
> id="book-Documentation-SCAP_and_STIG_Workshop-SCAP_and_STIG_Workshop">
> <title>SCAP and STIG Workshop</title>
> - <subtitle>An introduction into using and customizing SCAP content
> for Red Hat Enterprise Linux</subtitle>
> + <subtitle>An introduction to using and customizing SCAP content
> for Red Hat Enterprise Linux</subtitle>
> <!-- <productname>SCAP Security Guide Project</productname>
> <productnumber>1.0</productnumber> -->
> <productname>SCAP Security Guide</productname>
> diff --git a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> index 4618a51..deb3e06 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Introduction.xml
> @@ -9,7 +9,7 @@
> This workshop is intended to assist you in developing familiarity
> with, and skill in, the installation and customization of SCAP content
> for Red Hat Enterprise Linux, utilizing the DISA STIG baseline. Upon
> completion of this workshop, you should be able to return to your
> shop, obtain the SCAP components from Red Hat and DISA FSO, and be
> able to perform highly automated STIG scanning and reporting. Each
> attendee will be given a virtual machine to use for this workshop. The
> hostnames follow the syntax of:
> <screen>studentX.scapworkshop.com</screen></para>
> <para>
> - The initial login will be studentX, with a password of
> “password.” The root password is “redhat”. This workshop has been
> designed to be delivered over a two hour period, with each chapter
> building upon the prior. Should you have any questions, please raise
> your hand and the instructor(s) will be happy to assist.
> + The initial login will be "studentX", with a password of
> “password”. The root password is “redhat”. This workshop has been
> designed to be delivered over a two hour period, with each chapter
> building upon the prior. Should you have any questions, please raise
> your hand and the instructor(s) will be happy to assist.
> </para>
> </chapter>
>
> diff --git
> a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> index 99f8740..40106b9 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/SCAP_Security_Guide_Project.xml
> @@ -6,7 +6,7 @@
> <chapter
> id="chap-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project">
> <title>SCAP Security Guide Project</title>
> <para>
> - The <firstterm>SCAP Security Guide</firstterm> (SSG) Project
> delivers security guidance, baselines, and associated validation
> mechanisms using the <firstterm>Security Content Automation
> Protocol</firstterm> (SCAP). We currently provide content for
> <firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6) and
> <firstterm>JBoss Enterprise Application Server 5</firstterm> (JBoss
> EAP5). Other technologies are planned, such as KVM and Red Hat
> Storage, in CY2013.
> + The <firstterm>SCAP Security Guide</firstterm> (SSG) Project
> delivers security guidance, baselines, and associated validation
> mechanisms using the <firstterm>Security Content Automation
> Protocol</firstterm> (SCAP). We currently provide content for
> <firstterm>Red Hat Enterprise Linux 6</firstterm> (RHEL6),
> <firstterm>Fedora</firstterm>, and <firstterm>JBoss Enterprise
> Application Server 5</firstterm> (JBoss EAP5). Other technologies are
> planned, such as KVM and Red Hat Storage, in CY2014.
> </para>
> <para>
> The SSG project aspires to bridge the gap between generalized
> policy and specific implementation guidance, in SCAP formats to
> support automation whenever possible.
> @@ -17,23 +17,23 @@
> <section
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Background">
> <title>Background</title>
> <para>
> - Security guidance documents, such as the NSA RHEL5 SNAC
> Guide, have historically been authored in archaic static formats such
> as PDF files. This left much to be desired, particularly around
> automation, and individual shops were forced to create their own
> scripted hardening processes. These processes were authored in their
> own silos, by unique contractor teams, generally not shared across
> programs, and caused gross waste of tax payer dollars. Additionally,
> from a vendor perspective, supporting hardened environments was
> commercially unfeasible. As each shop held it's own processes, how
> could the vendor know what was changed and how to support it? The
> system was broke.
> + Security guidance documents, such as the NSA RHEL5 SNAC
> Guide, have historically been authored in archaic and static formats
> such as PDF files. This left much to be desired, particularly around
> automation, and individual shops were forced to create their own
> scripted hardening processes. These processes were authored in their
> own silos, by unique contractor teams, generally not shared across
> programs, and caused gross waste of taxpayer dollars. Additionally,
> from a vendor perspective, supporting hardened environments was
> commercially unfeasible. As each shop held its own processes, how
> could the vendor know what was changed and how to support it? The
> system was broken.
> </para>
> <para>
> - In May 2011, the <firstterm>Information Assurance
> Directorate of the National Security Agency</firstterm> (NSA IAD)
> invited Red Hat to begin collaboration on high quality security
> guidance for RHEL6. It was decided the content would be authored in
> SCAP formats to support automation, and thus the SCAP Security Guide
> project was born.
> + In May 2011, the <firstterm>Information Assurance
> Directorate of the National Security Agency</firstterm> (NSA IAD)
> invited Red Hat to collaborate on the development of high quality
> security guidance for RHEL6. It was decided the content would be
> authored in SCAP formats to support automation, and thus the SCAP
> Security Guide project was born.
> </para>
> <para>
> - Development of security guidance continued through May
> 2012, at which point Red Hat and NSA IAD contacted DISA Field Security
> Operations (DISA FSO) to begin development of the Red Hat Enterprise
> Linux 6 STIG. For the first time content development of a STIG would
> be open sourced. The movement towards transparent collaboration –
> between government agencies, industrial base partners, and content
> consumers – further reflects acceptance by the NSA and DISA FSO of the
> benefits of open source development models. On February 12th, 2013,
> DISA FSO released the first public Draft RHEL6 STIG which was derived
> from the upstream SCAP Security Guide project.
> + Development of security guidance continued through May
> 2012, at which point Red Hat and NSA IAD contacted DISA Field Security
> Operations (DISA FSO) to begin development of the Red Hat Enterprise
> Linux 6 STIG. For the first time content development of a STIG would
> be open sourced. This movement towards transparent collaboration –
> between government agencies, industrial base partners, and content
> consumers – further reflects acceptance by the NSA and DISA FSO of the
> benefits of open source development models. On February 12th, 2013,
> DISA FSO released the Draft RHEL6 STIG -- derived from the upstream
> SCAP Security Guide project.
> </para>
> <para>
> - This community powered innovation model has allowed the
> rapid creation of security baselines at dramatically reduced costs,
> shortened timeframes, and (arguably) has produced higher-quality
> content that has now become official U.S. Government standards.
> + This community driven innovation model has allowed the
> rapid creation of security baselines at dramatically reduced costs,
> shortened timeframes, and has produced higher-quality content that has
> produced official U.S. Government baselines and standards.
> </para>
> </section>
>
> <section
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Project_Charter">
> <title>Project Charter</title>
> <para>
> - The SSG community has a single goal: Develop usable
> security baselines across all Red Hat technology areas. Patches welcome!
> + The SSG community has a single goal: developing usable
> security baselines across all Red Hat technology areas. Patches are
> welcome!
> </para>
> </section>
> <section
> id="sect-Documentation-SCAP_and_STIG_Workshop-SCAP_Security_Guide_Project-Installation">
> --
> 1.7.1
>
> From 485ff3ec2ce0128430310c3d15c1cd05ca718f53 Mon Sep 17 00:00:00 2001
> From: David Smith <dsmith at secure-innovations.net>
> Date: Wed, 5 Mar 2014 12:51:30 -0800
> Subject: [PATCH][docs] workbook editing - part 2
>
>
> Signed-off-by: David Smith <dsmith at secure-innovations.net>
> ---
> .../en-US/Understanding_the_Components.xml | 21
> ++++++++++---------
> 1 files changed, 11 insertions(+), 10 deletions(-)
>
> diff --git
> a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> index e1e7369..94d0f57 100644
> --- a/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> +++ b/docs/SCAP_and_STIG_Workshop/en-US/Understanding_the_Components.xml
> @@ -50,7 +50,7 @@
> <title>OpenSCAP</title>
> <para>The SCAP protocol suite contains multiple complex data
> exchange formats that are used to transmit important vulnerability,
> configuration, and other security data. Historically there have been
> few tools that provide a way to query this data in the needed format.
> This lack of tools makes the barrier to entry very high and
> discourages adoption of these protocols by the community. It's the
> goal of the OpenSCAP project to create a framework of libraries and
> tools to improve the accessibility of SCAP
> and enhance the usability of the information it presents.</para>
> - <para>SCAP is a protocol, akin to HTML, and consumers must
> use a protocol interpreter. OpenSCAP provides that functionality for
> the RHEL platform.</para>
> + <para>SCAP is a protocol, akin to HTML, and consumers must
> use a protocol interpreter. OpenSCAP provides that functionality for
> Red Hat platforms.</para>
> <para>The OpenSCAP homepage can be found at <ulink
> url="http://www.open-scap.org/page/Main_Page" /></para>
> </section>
> <section
> id="sect-Documentation-SCAP_and_STIG_Workshop-Understanding_the_components-XCCDF">
> @@ -145,20 +145,21 @@ and enhance the usability of the information it
> presents.</para>
> <para>XCCDF rules are logically organized into profiles.
> To query which profiles are contained within the SCAP Security Guide
> project, run the following command:
> <screen>
> $ grep -n "<Profile"
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> -12: <Profile id="test">
> -68: <Profile id="common">
> -345: <Profile id="desktop" extends="common">
> -381: <Profile id="server" extends="common">
> -389: <Profile id="ftp" extends="server">
> -403: <Profile id="stig-rhel6-server" extends="common">
> +40: <Profile id="test">
> +67: <Profile id="CS2">
> +398: <Profile id="common">
> +613: <Profile id="server">
> +832: <Profile id="stig-rhel6-server">
> +1101: <Profile id="usgcb-rhel6-server">
> +1360: <Profile id="rht-ccp">
> </screen>
> </para>
> - <para>If you were to view line 403 and those proceeding,
> you will see a sampling of which rules make up the stig-rhel6-server
> profile:
> +<!-- <para>If you were to view line 403 and those
> proceeding, you will see a sampling of which rules make up the
> stig-rhel6-server profile:
> <screen>
> $ sed -n '403,413p' /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> <Profile id="stig-rhel6-server" extends="common">
> <title>Pre-release Draft STIG for RHEL 6 Server</title>
> -<description>This profile is being developed under the DoD
> consensus
> +<description>This profile is being developed under the DoD
> consensusi
> model to become a STIG in coordination with DISA
> FSO.</description>
> <select idref="encrypt_partitions" selected="true"/>
> <select idref="rpm_verify_permissions" selected="true"/>
> @@ -169,7 +170,7 @@ model to become a STIG in coordination with DISA
> FSO.</description>
> <select idref="disable_ctrlaltdel_reboot" selected="true"/>
> <select idref="service_postfix_enable" selected="true"/>
> </screen>
> - </para>
> + </para> -->
> </section>
> </section>
> </chapter>
> --
> 1.7.1
>
ack & thanks!
More information about the scap-security-guide
mailing list