Skip to content

Collateral and References

Jump to bottom Edit New page
Martin Preisler edited this page Jun 30, 2016 · 30 revisions

Public listing of presentations, whitepapers, and other collateral relating to SSG. Feel free to add links to your presentations!

Videos (Tutorials, Trainings, Overviews)

  • Using SCAP Workbench [YouTube]
  • RHEL7 SCAP Installer Add-on [YouTube]
  • SCAP Integration with RHN Satellite [YouTube]
  • Red Hat Satellite 6.1 Feature Overview: OpenSCAP [YouTube]

Conference Presentations

Interesting Press/Blogs/Articles

To keep things tidy, lets try MLA(ish) format:

Last, First M. "Article Title [as a link]." Newspaper Title Date Month Year Published: Page(s). Website Title.

References

While the SCAP Security Guide project was initially started to author content for the U.S. Military and Intelligence communities, usage has greatly expanded into healthcare, aviation, telecom, and several other industries. While not comprehensive, below is a listing of known uses:

  • Red Hat uses SSG for continuous monitoring of their openshift.com infrastructure, and has since 2012. Here's a blog posting from Tim Kramer, the OpenShift Security Lead.

  • In 2013, Red Hat joined Lockheed Martin's Cyber Alliance. Together, LMCO and Red Hat open sourced the previously classified RHEL6 baseline for the DoD Centralized Super Computing Facility, which received an ATO under the ICD 503 process, utilizing the CNSSI 1253 cross domain overlay. The code was put into the CSCF-RHEL6-MLS profile.

  • Through collaboration with DISA FSO, NSA's Information Assurance Directorate, and Red Hat, SSG serves as Red Hat's upstream for U.S. Department of Defense Security Technical Implementation Guides (STIGs). Backstory is available on Shawn Wells' blog.

  • A few university students have started receiving homework to install & scan systems via SSG.

  • Red Hat is using SSG in its courseware for the Red Hat Server Hardening (RH413) class.

  • Through sponsorship from the U.S. Navy, SSG serves as the upstream of the U.S. Government's implementation guide to JBoss EAP5.

  • Working with Amazon, SSG open sourced the RHEL6 baseline for CIA's C2S environment. This profile was based off the Center for Internet Security's Red Hat Enterprise Linux 6 Benchmark, v1.2.0, and while built for a U.S. Intelligence deployment, is applicable to all commercial entities who follow CIS v1.2.0. The code can be found here.

  • A number of other IC and DoD entities have developed customized XCCDF profiles based off of SSG for their RHEL6 baselines and security compliance verification.

  • A European airline utilizes SSG to verify security compliance of their in-seat entertainment systems.

  • A US-based financial services firm performs continuous monitoring with SSG, utilizing the STIG profile, ensuring their trade systems remain in compliance with their security policy.

Add a custom footer
Add a custom sidebar
Clone this wiki locally