Red Hat System Security & Management
A presentation at NSA Red Hat Symposium in in Fort Meade, MD, USA by Shawn Wells
SYSTEM SECURITY & MANAGEMENT SHAWN WELLS DIRECTOR, INNOVATION PROGRAMS unclass: shawn@redhat.com (+1) 443-534-0130 UNCLASSIFIED 1
60 MINUTES, 3 GOALS 1. Review compliance tech + initiatives spanning I4, TS13, DISA, NIST, and Red Hat 2. 3. • SCAP Security Guide • Security Baselines (CS2, STIG, etc) • Emerging Tech
60 MINUTES, 3 GOALS 1. Review compliance tech + initiatives spanning I4, TS13, DISA, NIST, and Red Hat • SCAP Security Guide • Security Baselines (CS2, STIG, etc) • Emerging Tech 2. T3 ATO’d System Management Framework 3. • System Provisioning, Patch Management, Monitoring, Conf Mgmt • Sponsored by T3 (“go redhat-support”)
60 MINUTES, 3 GOALS 1. Review compliance tech + initiatives spanning I4, TS13, DISA, NIST, and Red Hat • SCAP Security Guide • Security Baselines (CS2, STIG, etc) • Emerging Tech 2. T3 ATO’d System Management Framework • System Provisioning, Patch Management, Monitoring, Conf Mgmt • Sponsored by T3 (“go redhat-support”) 3. Demonstrate current capabilities
NSA C63 (aka NIAP) & Red Hat: where we’ve been… and next stop
SCAP Security Guide FSO I43, I411, TS13, T3 NVD U.S. Federal AUS Federal AppSec Engineering
RHEL5 STIG Delay: 1,988 days RHEL6 STIG Delay: 932 days
STIG Version 1, Release 2, Section 1.1: “The consensus content was developed using an open source project called SCAP Security Guide. The project’s website is https:// fedorahosted.org/scap-security-guide/. Except for differences in formatting to accommodate the DISA STIG publising process, the content of the RHEL6 STIG should mirror the SCAP Security Guide content with only minor divergences as updates from multiple sources work through the consensus process”
SCAP Security Guide • Guidance broken into profiles: • RHEL6 STIG • CS2 • NIST NVD (JBoss only) • FISMA Moderate (in progress)
<fix system=”urn:xccdf:fix:script:sh”> yum -y install aide </fix>
SYSTEMS MANAGEMENT 18
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 SYSTEM MANAGEMENT CAPABILITIES
T3 RHN Satellite v6: Launching in 2014 • An entirely new Satellite system • Puppet for Configuration • Foreman for Provisioning • Katello for Content Management • Pulp for Repo Management • Candlepin for Subscription Management
T3 RHN Satellite v6: Workflow
T3 RHN Satellite v6: Workflow
T3 RHN Satellite v6: Workflow
THANK YOU! 45
60 minute review of technology initiatives spanning NSA I4, TS13, DISA, NIST, and Red Hat. Reviewed the ATO’d T3 system management framework that afforded NSA Red Hat users system provisioning, patch management, monitoring, and configuration management capabilities.
