Security Content Automation Protocol (SCAP) which is a collection of standards managed by National Institute of Standards and Technology (NIST). It was created to provide a standardized approach to maintaining the Security of enterprise system, such as automatically Verifying the presence of patched, checking system security configuration settings, and examining systems for signs of compromise. Along with this Audience will also have a good view of Foreman, how openscap can be integrated with foreman and become more useful and efficient to use.

1. Securing Infrastructure with OpenScap
The Automation Way !!
Jaskaran Singh Narula
Red Hat Satellite Engineer

2. Agenda
● What is OpenSCAP?
● Why OpenSCAP?
● OpenSCAP Components
● OpenSCAP Tools
● Integration with Foreman
● How OpenSCAP works?
● Demo

3. To mitigate issue as :
● Software flaws as vulnerabilities
● Configuration flaws as weaknesses in hardening
What is OpenSCAP ?

4. ● A way to express security policies in user interactive format.
● SCAP is a NIST standard. It contains a set of data formats for security policies.
● A tool to verify if a system(s) or infrastructure makes up to certain certain
standards.
● Modification can be done using Tailoring files.
● It is supported on cross-platforms ( Windows and Linux ).
Why OpenSCAP ?

5. OpenSCAP Tools:
Scap WorkbenchAnaconda
Add-on
OpenScap Base
OpenScap Daemon
ScapTimony

6. OpenSCAP Components:
Languages :
● XCCDF - Extensible Configuration Checklist Descriptive Format
● OVAL - Open Vulnerability & Assessment
Reporting Formats :
● ARF - Asset Reporting Format

7. OpenSCAP Components:
Enumerations :
● CCE - Common Configuration Enumeration
● CPE - Common Platform Enumeration
● CVE - Common Vulnerability & Exposures
Measurement & Scoring System :
● CVSS - Common Vulnerability Scoring System

8. How OpenSCAP Works?

9. SCAP Profile
SCAP Content
Common Profile
PCI - DSS ProfileStandard Docker
Standard System Security Profile
Puppet Modules
or
Ansible Playbooks
Client System(s)

10. OpenSCAP Policies

15. Demo

17. OpenSCAP with other Infrastructures
● For small infrastructures:
- OpenSCAP-daemon
- OpenSCAP WorkBench
● For large(r) infrastructures:
- Foreman
- SUSE Manager
- Red Hat CloudForms (ManageIQ)
- Red Hat Satellite 5 (Spacewalk)
- Red Hat Satellite 6 (Foreman)

18. Integration OpenSCAP with Foreman
Foreman OpenSCAP

19. Introduction to Foreman

20. ● Features and Architecture
● Configurational Management
● Managing Security Compliance
● How does it add up to the picture?
How Foreman Help us ?

21. What is the need for Foreman

22. Provisioning with Foreman

23. Provisioning with Foreman
- Provision new machines or containers anything you wish like.
- Bare metal, oVirt, libvirt, VMware, Docker, EC2,
Rackspace, Digital Ocean, OpenStack, etc.

24. Configuration Management with Foreman

25. Configuration Management with Foreman
● Puppet
● Ansible
Automatic registration & setup of clients,
including auto signing certs/keys
● Defining:
- Classes / states
- Parameters / pillars
● Inventory data:
- Facts / Grains
- Results of configuration runs

26. Monitoring with Foreman
Generic Report API with graphs/trends:
–System Inventories
–Reports from runs
–Generic reports: OpenSCAP
Context sensitive search:
–Not full-text (SQL level)
–Keyword completion
–Works across whole application

27. Foreman Dashboard

28. Managing Hosts on Foreman

29. - Need to know XML in order to write your own custom rules.
- Only detects vulnerabilities in vendor’s packages
- Not in EPEL as of now.
- Not in 3rd party vendor repos like software that doesn’t come from RPMs/deb.
- Only detects vulnerabilities important enough to be fixed in RHSAs.
- Security Policies do not get updated automatically under Foreman, we need to automate the stuff.
Limitations Of OpenSCAP

30. Reference
https://github.com/OpenSCAP
https://www.open-scap.org/
https://isimluk.livejournal.com/
https://www.youtube.com/watch?v=DxMd0T9_apo
https://www.youtube.com/watch?v=X7yY49-Y7Xk
https://theforeman.org/
https://martin.preisler.me/
IRC Channels: #openscap #foreman

31. Questions ?
Contact Me:
Twitter: @JaskaranNarula
Mail ID: narula.jaskaran@gmail.com