scap-security-guide(8)

NAME
SCAP Security Guide - Delivers security guidance, baselines, and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP).

DESCRIPTION
The project provides practical security hardening advice for Red Hat products, and also links it to compliance requirements in order to ease deployment activities, such as certification and accreditation. These include requirements in the U.S. government (Federal, Defense, and Intelligence Community) as well as of the financial services and health care industries. For example, high-level and widely-accepted policies such as NIST 800-53 provides prose stating that System Administrators must audit "privileged user actions," but do not define what "privileged actions" are. The SSG bridges the gap between generalized policy requirements and specific implementation guidance, in SCAP formats to support automation whenever possible. The projects homepage is located at: https://fedorahosted.org/scap-security-guide/

PROFILES
The SSG content is broken into 'profiles,' groupings of security settings that correlate to a known policy. Available profiles are: stig-rhel6-server
    The Security Technical Implementation Guides (STIGs) and the NSA Guides are the configuration standards for DOD IA and IA-enabled devices/systems. Since 1998, DISA Field Security Operations (FSO) has played a critical role enhancing the security posture of DoD's security systems by providing the Security Technical Implementation Guides (STIGs). This profile was created as a collaboration effort between the National Security Agency, DISA FSO, and Red Hat. For additional information relating to STIGs, please refer to the DISA FSO webpage at http://iase.disa.mil/stigs/
usgcb-rhel6-server
    The purpose of the United States Government Configuration Baseline (USGCB) initiative is to create security configuration baselines for Information Technology products widely deployed across the federal agencies. The USGCB baseline evolved from the Federal Desktop Core Configuration mandate. The USGCB is a Federal government-wide initiative that provides guidance to agencies on what should be done to improve and maintain an effective configuration settings focusing primarily on security. NOTE: While the current content maps to USGCB requirements, it has NOT been validated by NIST as of yet. This content should be considered draft, we are highly interested in feedback. For additional information relating to USGCB, please refer to the NIST webpage at http://usgcb.nist.gov/usgcb_content.html.

EXAMPLES
To scan your system utilizing the OpenSCAP utility against the stig-rhel6-server profile: oscap xccdf eval --profile stig-rhel6-server --results /tmp/`hostname`-ssg-results.xml --report /tmp/`hostname`-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

Additional details can be found on the projects wiki page: https://fedorahosted.org/scap-security-guide/wiki/usageguide

FILES
/usr/share/xml/scap/ssg/content/
    Houses SCAP content utilizing the following naming conventions: CPE_Dictionaries: ssg-{profile}-cpe-dictionary.xml CPE_OVAL_Content: ssg-{profile}-cpe-oval.xml OVAL_Content: ssg-{profile}-oval.xml XCCDF_Content: ssg-{profile}-xccdf.xml
/usr/share/xml/scap/ssg/guides/
    HTML versions of SSG profiles.
/usr/share/xml/scap/ssg/policytables/
    HTML tables reflecting which institutionalized policy a particular SSG rule conforms to.

SEE ALSO
oscap(8)

AUTHOR
Please direct all questions to the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide