SCAP FAQ Ideas?

[Shawn Wells]

There are still many questions around using SCAP, such as the SCAP for 
CVE scanning thread a few days ago.

To begin documenting FAQs -- both for the OpenSCAP/SSG pages, and formal 
Red Hat documentation -- I've started to document common questions here:

https://github.com/OpenSCAP/scap-security-guide/wiki/What-should-go-into-an-...

What other topics/questions should be covered? Feel free to edit the 
wiki directly or reply to the list! This feedback will be driven into 
our wikis/manuals, and formal docs off redhat.com.

Don't limit to use SSG.... broader questions on how to store SCAP data, 
using OpenSCAP, how policy is developed all make sense!

[leam hall]

On Wed, Mar 25, 2015 at 11:04 AM, Shawn Wells  wrote:
> There are still many questions around using SCAP, such as the SCAP for CVE
> scanning thread a few days ago.
>
> To begin documenting FAQs -- both for the OpenSCAP/SSG pages, and formal Red
> Hat documentation -- I've started to document common questions here:
>
> https://github.com/OpenSCAP/scap-security-guide/wiki/What-should-go-into-an-...
>
> What other topics/questions should be covered? Feel free to edit the wiki
> directly or reply to the list! This feedback will be driven into our
> wikis/manuals, and formal docs off redhat.com.
>
> Don't limit to use SSG.... broader questions on how to store SCAP data,
> using OpenSCAP, how policy is developed all make sense!
> --

Okay, cool. My new joy is learning more about all this so I'll look
for the "I'm an idiot, what the heck is all this?" question.   ;)

Leam

[leam hall]

> On Wed, Mar 25, 2015 at 11:04 AM, Shawn Wells  wrote:
> > What other topics/questions should be covered? Feel free to edit the wiki
> > directly or reply to the list! This feedback will be driven into our
> > wikis/manuals, and formal docs off redhat.com.

Why are the Vulnerability IDs different for the issue across different STIGs?
 - Blame DISA

Where are the STIGs located?
 - iase.disa.mil

Is there a tool that correlates STIG Vuln IDs to CCE numbers, Nessus
plugins, or XYZ?
 - Dunno.

To answer questions 4 and 5, right now I'd say "The STIG is a basis
for measurement. The SCAP content contains some STIG material as well
as community best practice."

Leam

[Tim Moor]

Not sure these are FAQ's, more HOWTO's but I'll take a stab at it.

How do I install SCAP
How do I use SCAP to remediate conditions
How do I edit or create my own SCAP Policy
Where can I find other SCAP profiles? [different public sources of xccdf 
scap profiles]
Is there a way to detect exposure to a cve [CVE-2014-7169]?
What tooling is available for scap [SCAP Workbench, ..., ...]?

On 26/03/15 04:04, Shawn Wells wrote:
> There are still many questions around using SCAP, such as the SCAP for
> CVE scanning thread a few days ago.
>
> To begin documenting FAQs -- both for the OpenSCAP/SSG pages, and formal
> Red Hat documentation -- I've started to document common questions here:
>
> https://github.com/OpenSCAP/scap-security-guide/wiki/What-should-go-into-an-...
>
> What other topics/questions should be covered? Feel free to edit the
> wiki directly or reply to the list! This feedback will be driven into
> our wikis/manuals, and formal docs off redhat.com.
>
> Don't limit to use SSG.... broader questions on how to store SCAP data,
> using OpenSCAP, how policy is developed all make sense!