# Introduction to SSG

## Project Description

The SCAP Security Guide (SSG) project delivers security guidance, baselines and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP). SSG currently provides content for Red Hat Enterprise Linux 6 (RHEL6) and JBoss Enterprise Application Server 5 (JBoss EAP5).

In addition to hardening advice, SSG links back to compliance requirements in order to eease deployment activities, such as certification and accreditation. These include requirements in the U.S. Government (Federal, Defense, and Intelligence Community) as well as of the financial services and health care industries. For example, high-level and widely-accepted policies such as NIST 80-53 provide prose stating that System Administrators must audit "privileged user actions," but do not define what "privileged actions" are. The SSG bridges the gap between generalized policy requirements and specific implementation guidance, in SCAP formats to support automation whenever possible.

The project homepage is https://fedorahosted.org/scap-security-guide/.

## Government/Industry Collaboration

| The National Security Agency's Information Assurance Directorate (NSA IAD) is presidentially mandated to protect Confidential, Secret and Top Secret information that could reasonably be expected to cause damage to U.S. National Security. As part of this mission, NSA develops and distributes configuration guidance for operating systems. These guides are currently being used throughout the U.S. government and by numerous entities as a security baseline for their systems. The SCAP Security Guide project serves as NSA's upstream source for Red Hat Enterprise Linux operating system guidance.
| The U.S. Defense Information Systems Agency, Field Security Operations (DISA FSO) authors hardening guidance known as Security Technical Implementation Guides (STIGs). These documents, used throughout the U.S. Military to harden systems, establish formal security compliance baselines. The SCAP Security Guide project serves as the usptream development source for Red Hat STIG content and helps DISA FSO move towards their business objective of utilizing SCAP-based formates to automate security compliance across U.S. Military organizations.
| NIST publishes 'National Checklists' for software, which as defined directly by NIST: The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 2, is the U.S. Government repositiory of publicly available securiyy checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications. NCP is migrating its repository of checklists to conform to the Security Content Automation Protocol (SCAP). The SCAP Security Guide project serves as the upstream repository for Red Hat related checklists, such as the JBoss Enterprise Application Platform 5 (JBoss EAP5) baseline.