scap-security-guide

NAME
DESCRIPTION
PROFILES
EXAMPLES
FILES
STATEMENT OF SUPPORT
DEPLOYMENT TO U.S. CIVILIAN GOVERNMENT SYSTEMS
DEPLOYMENT TO U.S. MILITARY SYSTEMS
SEE ALSO
AUTHOR

NAME

SCAP Security Guide - Delivers security guidance, baselines, and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP).

DESCRIPTION

The project provides practical security hardening advice for Red Hat products, and also links it to compliance requirements in order to ease deployment activities, such as certification and accreditation. These include requirements in the U.S. government (Federal, Defense, and Intelligence Community) as well as of the financial services and health care industries. For example, high-level and widely-accepted policies such as NIST 800-53 provides prose stating that System Administrators must audit "privileged user actions," but do not define what "privileged actions" are. The SSG bridges the gap between generalized policy requirements and specific implementation guidance, in SCAP formats to support automation whenever possible.

The projects homepage is located at: https://fedorahosted.org/scap-security-guide/

PROFILES

The SSG content is broken into ’profiles,’ groupings of security settings that correlate to a known policy. Available profiles are:

rht-cpp

Red Hat Corporate Profile for Certified Cloud Providers (RH CCP). This is a *draft* SCAP profile for Red Hat Certified Cloud Providers.

EXAMPLES

To scan your system utilizing the OpenSCAP utility against the rht-ccp profile:

oscap xccdf eval --profile rht-ccp   --results /tmp/‘hostname‘-ssg-results.xml --report /tmp/‘hostname‘-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel7-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml

Additional details can be found on the projects wiki page: https://fedorahosted.org/scap-security-guide/wiki/usageguide

FILES

/usr/share/xml/scap/ssg/content/

Houses SCAP content utilizing the following naming conventions:

CPE_Dictionaries: ssg-{profile}-cpe-dictionary.xml

CPE_OVAL_Content: ssg-{profile}-cpe-oval.xml

OVAL_Content: ssg-{profile}-oval.xml

XCCDF_Content: ssg-{profile}-xccdf.xml

/usr/share/doc/scap-security-guide-0.1.19

Contains HTML versions of the SSG profiles and also HTML tables reflecting which institutionalized policy a particular SSG rule conforms to.

STATEMENT OF SUPPORT

The SCAP Security Guide, an open source project jointly maintained by Red Hat and the NSA, provides XCCDF and OVAL content for Red Hat technologies. As an open source project, community participation extends into U.S. Department of Defense agencies, civilian agencies, academia, and other industrial partners.

SCAP Security Guide is provided to consumers through Red Hat’s system and content management services (Red Hat Network Classic or Red Hat Subscription Management). As such, SCAP Security Guide content is considered "vendor provided."

Note that while Red Hat hosts the infrastructure for this project and Red Hat engineers are involved as maintainers and leaders, there is no commercial support contracts or service level agreements provided by Red Hat.

Support, for both users and developers, is provided through the SCAP Security Guide community.

Homepage: https://fedorahosted.org/scap-security-guide/

Mailing List: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

DEPLOYMENT TO U.S. CIVILIAN GOVERNMENT SYSTEMS

SCAP Security Guide content is considered vendor (Red Hat) provided content. Per guidance from the U.S. National Institute of Standards and Technology (NIST), U.S. Government programs are allowed to use Vendor produced SCAP content in absence of "Governmental Authority" checklists. The specific NIST verbage: http://web.nvd.nist.gov/view/ncp/repository/glossary?cid=1#Authority

DEPLOYMENT TO U.S. MILITARY SYSTEMS

DoD Directive (DoDD) 8500.1 requires that "all IA and IA-enabled IT products incorporated into DoD information systems shall be configured in accordance with DoD-approved security configuration guidelines" and tasks Defense Information Systems Agency (DISA) to "develop and provide security configuration guidance for IA and IA-enabled IT products in coordination with Director, NSA." The output of this authority is the DISA Security Technical Implementation Guides, or STIGs. DISA FSO is in the process of moving the STIGs towards the use of the NIST Security Content Automation Protocol (SCAP) in order to "automate" compliance reporting of the STIGs.

Through a common, shared vision, the SCAP Security Guide community enjoys close collaboration directly with NSA and DISA FSO. As stated in Section 1.1 of the RHEL6 STIG Overview, Version 1, Release 2, issued on 03-JUNE-2013:

"The consensus content was developed using an open-source project called SCAP Security Guide. The project’s website is https://fedorahosted.org/scap-security-guide/. Except for differences in formatting to accomodate the DISA STIG publishing process, the content of the RHEL6 STIG should mirrot the SCAP Security Guide content with only minor divergence as updates from multiple sources work through the concensus process."

The DoD STIG for Red Hat Enterprise Linux 6 was released June 2013. Currently, the DoD RHEL6 STIG contains only XCCDF content and is available online: http://iase.disa.mil/stigs/os/unix/red_hat.html

Content published against the iase.disa.mil website is authoritative STIG content. The SCAP Security Guide project, as noted in the STIG overview, is considered upstream content. Unlike DISA FSO, the SCAP Security Guide project does publish OVAL automation content. Individual programs and C&A evaluators make program-level determinations on the direct usage of the SCAP Security Guide. Currently there is no blanket approval.

SEE ALSO

oscap(8)

AUTHOR

Please direct all questions to the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide