<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 4/18/14, 3:14 PM, Greg Elin wrote:<br>
</div>
<blockquote
cite="mid:CACZRBDR4-tK0wUzEW_dP=Y5tZ8BB+kzm+rB2a7xZYH-HoXE54Q@mail.gmail.com"
type="cite">
<div dir="ltr">Greetings all --
<div><br>
</div>
<div>I became involved with SCAP and SSG as part of grant from
the Knight Foundation to support government innovation by
creating tools and servers that meet government regulations,
so that developers can easily build and adopt new technology.
(More here: <a moz-do-not-send="true"
href="http://www.knightfoundation.org/grants/201345714/">http://www.knightfoundation.org/grants/201345714/</a>)</div>
<div><br>
</div>
<div>Basically, I want leverage SCAP so developers start with
accreditation-ready environments and security is baked into
the development process.</div>
<div><br>
</div>
<div>Right now, I am focusing on a "GovReady" toolkit so people
can more easily add SCAP and vulnerability scanning into their
projects; and a GovReady Clearinghouse of content to help
people find ready versions of software.</div>
<div><br>
</div>
<div><b>I'm looking for a few volunteers to provide ongoing
feedback on the prototypes we are building. </b></div>
<div><b><br>
</b></div>
<div><b>Anyone interested in seeing early prototypes and
providing feedback?</b> We want to make the content easier
for everyone to work with: Security folks, administrators,
developers, even business side.</div>
<div><br>
</div>
<div>Thanks!</div>
</div>
</blockquote>
<br>
For those in the broader SSG community, I had the chance to speak
with Greg awhile back. Some here may know him from his former life
as the Chief Data Officer at the FCC. GitMachine's goals greatly
align with SSG.<br>
<br>
Greg, to perhaps provide some engagement, could you outline:<br>
- How is your work different than Red Hat providing STIG'd and
otherwise hardened (e.g. C2S) AMIs?<br>
- How are your tools different than preexisting hardening scripts,
which configure machines to STIG, FISMA, and other baselines (e.g.
Aqueduct and github.com/redhatgov)?<br>
- What other components make a "GovReady" toolkit? <br>
- To better understand how the SSG community could help, how does
SSG fit into your work?<br>
</body>
</html>