[RFC] SCAP security guide to become member of larger community - OpenSCAP ecosystem by changing it's name to OpenSCAP security guide?
gregelin at gitmachines.com
Thu May 1 07:25:26 UTC 2014
Learning about this baselines and SCAP over past year+ has been confusing.
So I like idea of re naming and rebranding to improve adoption and use.
SCAP, SSG, SSP, etc. I have been in IT for 20 years and have worked for telcos and fed gov. Though I am no stranger to acronyms, SSG is very confusing bc of SSP and not in a good way. OpenSCAP Security Guide remains confusing. Is OpenSCAP a definer of security configuration baselines itself?
I thought OpenSCAP is a tool that can interpret any guide (eg profile) written in SCAP, right?
If I follow SSG do I immediately get a baseline for Federal Desktop or Server? My current understanding is "kinda" only bc the default profile is base on it but "not really" bc you can change the profiles and you are suppose to.
It seems to me OpenSCAP is a tool. And any Guide must be tied to a baseline config from an authority with ability to accept and bless implementations and tests of that config. As a developer or Auditor, isn't what I care about the is the configuration as per an authority issue and approving it?
E: gregelin at gitmachines.com
Sent from my iPhone
> On Apr 30, 2014, at 7:14 PM, Steve Grubb <sgrubb at redhat.com> wrote:
>> On Wednesday, April 30, 2014 10:08:04 AM Jan Lieskovsky wrote:
>> Since there's effort to create OpenSCAP ecosystem, of which SCAP security
>> guide project is its indisputable part, besides cloning the repository, the
>> other natural subsequent step, coming to mind is to have the project
>> renamed from SCAP security guide to OpenSCAP security guide.
> While the SSG project uses oscap to manipulate the xml, the results are by no
> means exclusive to openscap. I think the resulting documents should be tool
> neutral. IOW, its part of a bigger ecosystem "as is".
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
More information about the scap-security-guide