scap-security-guide September 2011

scap-security-guide@lists.fedorahosted.org

3 participants
2 discussions

scap-security-guide: building SCAP content for RHEL 6
by Jeffrey Blank 29 Sep '11

29 Sep '11

Aqueduct list, I wanted to bring to your attention a new project on fedorahosted: https://fedorahosted.org/scap-security-guide It is designed to provide security guidance and checking content in the SCAP formats. Specifically, the project goal is to produce --- from a single body of content: 1) an informative prose guide, similar in style to NSA's RHEL 5 guide 2) a desktop settings baseline, similar in style to NIST USGCB 3) a server settings baseline, similar in style to a STIG 4) additional baselines for other network roles (such as LAMP server) 5) a body of automated checking content in the OVAL format Currently, we are engaged in updating NIST's beta USGCB content for RHEL 5 Desktop to RHEL 6. We continue to evolve simple scripts for creating and manipulating such content in an agile fashion. A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov) To grossly simplify, consider it a set of XML schema that describe configuration checklists/guides, and also how to carry out checks for compliance (and patching). Content expressed in the SCAP formats can be very verbose/ugly, but there is a significant benefit in that a growing body of commercially available tools can ingest SCAP content and provide results in standardized formats. For the enterprise, this is very significant. The OpenSCAP project provides a very important automation/testing and presentation capabilities for such content, and we use it for guide generation and unit testing of checks. The scap-workbench project allows for easy editing and tailoring of such content (for end-users). When fully developed, we intend to endorse the prose and associated checking content developed on scap-security-guide as best practice guidance. As Aqueduct provides deployment resources for compliance with security baselines from multiple organizations, we would like to maintain close coordination. We welcome your participation, particularly if you have information that you believe represents security best practice for RHEL 6. If you are familiar with SCAP formats and would like to participate directly in the creation of XCCDF, OVAL or OCIL content, such expertise is particularly valued. Please feel free to send questions to the mailing list at scap-security-guide(a)lists.fedorahosted.org , or directly to me. Thanks, Jeff ___________________________ Jeffrey Blank 410-854-8675 Global Mitigations NSA Information Assurance

2 1

A few questions.
by Trevor Vaughan 14 Sep '11

14 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, Do we have any rules of the road for wiki etiquette at this point? Should we just update as we see fit? Is there a dedicated maintainer, etc...? For items that we may want to add to the checks, etc.., should we post a ticket with the idea, or toss it up to the mailing list first? I'm unfortunately going to be a bit sporadic in terms of participation, but I'll certainly do what I can, when I can. Thanks! Trevor - -- Trevor Vaughan Vice President, Onyx Point, Inc. email: tvaughan(a)onyxpoint.com phone: 410-541-ONYX (6699) pgp: 0x6C701E94 - -- This account not approved for unencrypted sensitive information -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEcBAEBAgAGBQJOaYl5AAoJECNCGV1OLcypWU0IAIY5y2/W4kU4XKirpbgJnNRa G5tchWFzxiKrS9XQe8TiZWNNYMmmbbZxy05SRku3FSf0zTIZsiUqRxoQaZsPqsb4 seWwZmyu/DUYJD9UGGSJAb9Zy7NWoPZYDMdfz5OJw6bRGy1LQRUofwmxsFlydtuU xWCLm1XZO9HpU459SAEQKUqMY8SI90l2t18j5I8PZTgYETtWqE9LUOj1eENC/INi 2hd99asvhH+PLOujw1UOmCrApeqVvt6PYWAbTk/3U4y8trUo3H6JJRJvbAJnEZdS SbHlPogY+WQPG1QREi5SgbeLUG+sjBxjUradPoCo/LPlKuZMf0OGXerzKQqDnGo= =6Eot -----END PGP SIGNATURE-----

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide September 2011