Aqueduct list,
I wanted to bring to your attention a new project on fedorahosted: https://fedorahosted.org/scap-security-guide
It is designed to provide security guidance and checking content in the SCAP formats. Specifically, the project goal is to produce --- from a single body of content:
1) an informative prose guide, similar in style to NSA's RHEL 5 guide 2) a desktop settings baseline, similar in style to NIST USGCB 3) a server settings baseline, similar in style to a STIG 4) additional baselines for other network roles (such as LAMP server) 5) a body of automated checking content in the OVAL format
Currently, we are engaged in updating NIST's beta USGCB content for RHEL 5 Desktop to RHEL 6. We continue to evolve simple scripts for creating and manipulating such content in an agile fashion.
A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov): To grossly simplify, consider it a set of XML schema that describe configuration checklists/guides, and also how to carry out checks for compliance (and patching). Content expressed in the SCAP formats can be very verbose/ugly, but there is a significant benefit in that a growing body of commercially available tools can ingest SCAP content and provide results in standardized formats. For the enterprise, this is very significant.
The OpenSCAP project provides a very important automation/testing and presentation capabilities for such content, and we use it for guide generation and unit testing of checks. The scap-workbench project allows for easy editing and tailoring of such content (for end-users).
When fully developed, we intend to endorse the prose and associated checking content developed on scap-security-guide as best practice guidance. As Aqueduct provides deployment resources for compliance with security baselines from multiple organizations, we would like to maintain close coordination.
We welcome your participation, particularly if you have information that you believe represents security best practice for RHEL 6. If you are familiar with SCAP formats and would like to participate directly in the creation of XCCDF, OVAL or OCIL content, such expertise is particularly valued.
Please feel free to send questions to the mailing list at scap-security-guide@lists.fedorahosted.org , or directly to me.
Thanks, Jeff
___________________________ Jeffrey Blank 410-854-8675 Global Mitigations NSA Information Assurance
Jeff,
This is great stuff and welcome to the mailing list. I believe the Aqueduct community would be very interested in contributing to your effort and also serving as an exchange for the content to a broader audience. Would you like a bullet point on our next community call to explain and answer questions?
Aaron Prayther, this is a good bullet for the agenda. Are you ready to be the ring master next Friday? :)
-James
On Sep 28, 2011, at 8:34 PM, Jeffrey Blank blank@eclipse.ncsc.mil wrote:
Aqueduct list,
I wanted to bring to your attention a new project on fedorahosted: https://fedorahosted.org/scap-security-guide
It is designed to provide security guidance and checking content in the SCAP formats. Specifically, the project goal is to produce --- from a single body of content:
- an informative prose guide, similar in style to NSA's RHEL 5 guide
- a desktop settings baseline, similar in style to NIST USGCB
- a server settings baseline, similar in style to a STIG
- additional baselines for other network roles (such as LAMP server)
- a body of automated checking content in the OVAL format
Currently, we are engaged in updating NIST's beta USGCB content for RHEL 5 Desktop to RHEL 6. We continue to evolve simple scripts for creating and manipulating such content in an agile fashion.
A quick primer on SCAP (scap.nist.gov and usgcb.nist.gov): To grossly simplify, consider it a set of XML schema that describe configuration checklists/guides, and also how to carry out checks for compliance (and patching). Content expressed in the SCAP formats can be very verbose/ugly, but there is a significant benefit in that a growing body of commercially available tools can ingest SCAP content and provide results in standardized formats. For the enterprise, this is very significant.
The OpenSCAP project provides a very important automation/testing and presentation capabilities for such content, and we use it for guide generation and unit testing of checks. The scap-workbench project allows for easy editing and tailoring of such content (for end-users).
When fully developed, we intend to endorse the prose and associated checking content developed on scap-security-guide as best practice guidance. As Aqueduct provides deployment resources for compliance with security baselines from multiple organizations, we would like to maintain close coordination.
We welcome your participation, particularly if you have information that you believe represents security best practice for RHEL 6. If you are familiar with SCAP formats and would like to participate directly in the creation of XCCDF, OVAL or OCIL content, such expertise is particularly valued.
Please feel free to send questions to the mailing list at scap-security-guide@lists.fedorahosted.org , or directly to me.
Thanks, Jeff
Jeffrey Blank 410-854-8675 Global Mitigations NSA Information Assurance
aqueduct mailing list aqueduct@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/aqueduct
scap-security-guide@lists.fedorahosted.org
-
James Labocki -
Jeffrey Blank