Red Hat Security Update
A presentation at Red Hat Partner Training in in McLean, VA, USA by Shawn Wells
Red Hat Security Update SHAWN WELLS Unclass: shawn@redhat.com JWICS: wellshaw@nro.ic.gov (+1) 443-534-0130 THIS BRIEFING IS UNCLASSIFIED 1
In the next hour … - Factual information to answer security compliance questions - Learn how to use Red Hat security compliance as a competitive advantage during sales cycle - Understand where Red Hat technologies & services fit into certification and accreditation stages of the deal
Understanding Common Criteria - Internationally standardized evaluation process to validate commercial technologies perform as advertised
Understanding Common Criteria - Internationally standardized evaluation process to validate commercial technologies perform as advertised - NSTISSP No. 11: Mandates government agencies only procure software which has been FIPS and Common Criteria certified. Effective since 1-JULY-2002. - No waiver process! - Products “In Evaluation” may receive conditional Deferred Compliance Authorization (DCA), which will be revoked if technology fails to pass Common Criteria
Understanding Common Criteria - Internationally standardized evaluation process to validate commercial technologies perform as advertised - NSTISSP No. 11: Mandates government agencies only procure software which has been FIPS and Common Criteria certified. Effective since 1-JULY-2002. - No waiver process! - Products “In Evaluation” may receive conditional Deferred Compliance Authorization (DCA), which will be revoked if technology fails to pass Common Criteria - Reviews development processes in addition to capabilities
Red Hat Enterprise Linux 6 with KVM Red Hat Enterprise Linux 5.6 with KVM 2012-10-08 2012-04-20 2008-08-06 2012-05-18 2010-12-15 2009-07-24 BSI-DSZ-CC -0724-2012 BSI-DSZ-CC -0472-2008 383-4189-CR 383-4-145 383-4-147 BSI-DSZ-CC -0570-2009 EAP4+ EAP4+ EAP4+ EAP4+ EAP4+ EAP4+ CAPP YES YES YES NO NO NO RBAC YES YES NO NO NO NO LSPP YES YES YES NO NO NO Certification Date Certification Number EAL Level IBM z/VM VMWare Version 5 vSphere 5.0 Release 3 (for IBM System z Mainframes) VMWare ESXi Microsoft 4.1 Windows Server 2008 Hyper-V Role with HotFix KB950050 CAPP: Users control who access’ their data RBAC: Users classified into roles (“BackupAdm,” “AuditAdm”…) LSPP: Compartmentalizes users and applications from each other. Enables MLS.
Common Criteria, NIST, STIG, USGCB Common Criteria tells the government software can be “trusted” ê ê ê
Common Criteria, NIST, STIG, USGCB Common Criteria tells the government software can be “trusted” ê NIST publishes a catalog of security best practices (“You must use secure passwords!”) ê ê
Common Criteria, NIST, STIG, USGCB Common Criteria tells the government software can be “trusted” ê NIST publishes a catalog of security best practices (“You must use secure passwords!”) ê Agencies select practices they agree with, and refine them (“NSA secure passwords must be 100 characters”) ê
Common Criteria, NIST, STIG, USGCB Common Criteria tells the government software can be “trusted” ê NIST publishes a catalog of security best practices (“You must use secure passwords!”) ê Agencies select practices they agree with, and refine them (“NSA secure passwords must be 100 characters”) ê Agencies aggregate refined values into Agency baselines (e.g. STIG for DOD, USGCB for Civilian)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) SELECT CONTROLS (FIPS 200 / SP 800-53)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) SELECT CONTROLS (FIPS 200 / SP 800-53) IMPLIMENT CONTROLS (SP 800-70)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) SELECT CONTROLS (FIPS 200 / SP 800-53) IMPLIMENT CONTROLS (SP 800-70) ASSESS CONTROLS (SP 800-53A)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) SELECT CONTROLS (FIPS 200 / SP 800-53) AUTHORIZE (SP 800-37) IMPLIMENT CONTROLS (SP 800-70) ASSESS CONTROLS (SP 800-53A)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) MONITOR (SP 800-37 / SP 800-53A) SELECT CONTROLS (FIPS 200 / SP 800-53) AUTHORIZE (SP 800-37) IMPLIMENT CONTROLS (SP 800-70) ASSESS CONTROLS (SP 800-53A)
What is the C&A process? CATEGORIZE (FIPS 199 / SP 800-60) GPS SCA + S P S atell ecu i te + r MONITOR i ty G uide (SP 800-37 / SP 800-53A) AUTHORIZE (SP 800-37) SELECT CONTROLS (FIPS 200 / SP 800-53) IMPLIMENT CONTROLS (SP 800-70) ASSESS CONTROLS (SP 800-53A) GPS + SCAP Security Guide
Session for partners to review:
-
Factual information to answer security compliance questions
-
Learn how to use Red Hat security compliance as a competitive advantage during sales cycle
-
Understand where Red Hat technologies and services fit into certification and accreditation states of the deal
