# SCAP Security Guide Project

The SCAP Security Guide (SSG) Project delivers security guidance, baselines, and associated validation mechanisms using the Security Content Automation Protocol (SCAP). We currently provide content for Red Hat Enterprise Linux 6 (RHEL6), Fedora, and JBoss Enterprise Application Server 5 (JBoss EAP5). Other technologies are planned, such as KVM and Red Hat Storage, in CY2014.

The SSG project aspires to bridge the gap between generalized policy and specific implementation guidance, in SCAP formats to support automation whenever possible.

The project homepage is .

## Background

Security guidance documents, such as the NSA RHEL5 SNAC Guide, have historically been authored in archaic and static formats such as PDF files. This left much to be desired, particularly around automation, and individual shops were forced to create their own scripted hardening processes. These processes were authored in their own silos, by unique contractor teams, generally not shared across programs, and caused gross waste of taxpayer dollars. Additionally, from a vendor perspective, supporting hardened environments was commercially unfeasible. As each shop held its own processes, how could the vendor know what was changed and how to support it? The system was broken.

In May 2011, the Information Assurance Directorate of the National Security Agency (NSA IAD) invited Red Hat to collaborate on the development of high quality security guidance for RHEL6. It was decided the content would be authored in SCAP formats to support automation, and thus the SCAP Security Guide project was born.

Development of security guidance continued through May 2012, at which point Red Hat and NSA IAD contacted DISA Field Security Operations (DISA FSO) to begin development of the Red Hat Enterprise Linux 6 STIG. For the first time content development of a STIG would be open sourced. This movement towards transparent collaboration – between government agencies, industrial base partners, and content consumers – further reflects acceptance by the NSA and DISA FSO of the benefits of open source development models. On February 12th, 2013, DISA FSO released the Draft RHEL6 STIG -- derived from the upstream SCAP Security Guide project.

This community driven innovation model has allowed the rapid creation of security baselines at dramatically reduced costs, shortened timeframes, and has produced higher-quality content that has produced official U.S. Government baselines and standards.

## Project Charter

The SSG community has a single goal: developing usable security baselines across all Red Hat technology areas. Patches are welcome!

## Installation

The SCAP Security Guide content was developed on, and for, Red Hat Enterprise Linux 6. The content likely will not work on prior releases, Fedora, or CentOS, without modification. This workshop assumes you have access to a RHEL6 machine. Please note latest download instructions will always be found at the SSG homepage, located here: .

1. To enable the SSG EPEL repository, you must download the yum .repo file for the project:

       $ wget -O ~/epel-6-scap-security-guide.repo \
       http://repos.fedorapeople.org/repos/scap-security-guide/epel-6-scap-
       security-guide.repo
       $ su -c "/bin/mv ~shawn/epel-6-scap-security-guide.repo /etc/yum.repos.d/"

2. Next, install SSG via yum:

       $ sudo sh -c “yum install scap-security-guide”

   Please note this may pull down other dependencies, such as the OpenSCAP tooling, if they are not part of your current baseline.