Applied SCAP: Automating Security Compliance and Remediation. Shawn Wells Maintainer, SCAP Security Guide 31-JULY-2014
|
|
|
- Ruby Craig
- 5 years ago
- Views:
Transcription
1 Applied SCAP: Automating Security Compliance and Remediation Shawn Wells Maintainer, SCAP Security Guide 31-JULY-2014
2 45 MINUTES, 3 GOALS (+15 MIN Q&A) 1. Detail Security Automation Technology + Initiatives Native Tooling [ OpenSCAP ] Configuration Compliance [ SCAP Security Guide ] Evolving Remediation Capabilities [ currently, bash + puppet ]
3 45 MINUTES, 3 GOALS (+15 MIN Q&A) 1. Detail Security Automation Technology + Initiatives Native Tooling [ OpenSCAP ] Configuration Compliance [ SCAP Security Guide ] Evolving Remediation Capabilities [ currently, bash + puppet ] 2. Live Demo Configuration Compliance Scanning Patch & Vulnerability Scanning Certification/Accreditation Paperwork Generation
4 45 MINUTES, 3 GOALS (+15 MIN Q&A) 1. Detail Security Automation Technology + Initiatives Native Tooling [ OpenSCAP ] Configuration Compliance [ SCAP Security Guide ] Evolving Remediation Capabilities [ currently, bash + puppet ] 2. Live Demo Configuration Compliance Scanning Patch & Vulnerability Scanning Certification/Accreditation Paperwork Generation 3. Discuss Roadmap (Gov t Plans, Packaging, Future Profiles)
5 FIRST, AN SCAP PRIMER A family of specifications managed by NIST Really a bunch of XML schema which are data formats so not a protocol at all, it turns out openly defined, community developed, and evolving So, what kind of data do these formats organize?
6 FIRST, AN SCAP PRIMER Defines standardized formats okay, but why bother? Because you ll get: Standardized inputs (e.g. a compliance baseline, status query) Standardized outputs (results) Provides the enterprise liberty with regard to product choices Avoids vendor lock-in, enables interoperability Provides common technical position to vendors Federal procurement language requires SCAP support in some cases
7 SCAP Security Guide
8 Contributors Include
9 In A Nutshell, SCAP Security Guide has had 2,408 commits from 36 contributors, representing 224,872 lines of code took an estimated 43 years of effort (COCOMO model) has become upstream for all Red Hat STIGs, NIST NVD for JBoss, NSA s RHEL SNAC Guides
10 DISA STIG, Version 1, Release 2, Section 1.1: The consensus content was developed using an open source project called SCAP Security Guide. The project s website is Except for differences in formatting to accommodate the DISA STIG publishing process, the content of the RHEL6 STIG should mirror the SCAP Security Guide content with only minor divergences as updates from multiple sources work through the consensus process
11 RHEL 5 STIG: RHEL 6 STIG: RHEL 7 STIG:
12 RHEL 5 STIG: 1,988 DAYS RHEL 6 STIG: RHEL 7 STIG:
13 RHEL 5 STIG: 1,988 DAYS RHEL 6 STIG: 932 DAYS RHEL 7 STIG:
14 RHEL 5 STIG: 1,988 DAYS RHEL 6 STIG: 932 DAYS RHEL 7 STIG: +/- 90 DAYS
15 TECH + INITIATIVES Native Tooling, Configuration Compliance, Evolving Remediation Capabilities
16 TOOLS vs CONTENT
17 OpenSCAP
18 SCAP ACRONYM: XCCDF extensible Configuration Checklist Description Format Human(ish) readable, format for configuration <Rule>s <Rule>s selected to form <Profile>s <refine-value>s
19 SCAP ACRONYM: OVAL Open Vulnerability and Assessment Language Specifies how to get information about system configuration Stores it in a structured, well defined format
20 XCCDF PROFILES Shipping as of 16-APR-2014: C2S: Commercial baseline derived from CIS v1.2.0 [1] (go google Amazon C2S ) CS2: RHEL6 baseline example for Intelligence Community CSCF: NRO s Centralized Super Computer Facility (CSCF) Baseline (cross domain controls from CNSSI 1253) STIG: U.S. DoD RHEL6 baseline, produced by DISA FSO [1]
21 REMEDIATION CAPABILITIES Bash first <fix system="urn:xccdf:fix:script:sh"> yum -y install screen </fix>
22 REMEDIATION CAPABILITIES Bash first Soon(ish), puppet <fix-group id="puppet-clip system="urn:xccdf:fix:script:puppet xmlns=" <fix rule="disable_vsftp">class vsftp</fix> <fix rule="package_aide_installed">class aide</fix> </fix-group>
23 <result>error</result> <rule-result idref="xccdf_moc.elpmaxe.www_rule_1 time=" t19:15:11" weight=" "> " "<result>error</result> " "<message severity="info"> " ""Fix execution comleted and returned: 1 " "</message> " "<message severity="info"> " ""Loaded plugins: auto-update-debuginfo, langpacks, presto, " ""refresh-packagekit " ""You need to be root to perform this command. " "</message> </rule-result>"
24 <result>fixed</result> <rule-result idref="xccdf_moc.elpmaxe.www_rule_1 time=" t19:16:03" weight=" "> <result>fixed</result> <message severity="info">fix execution completed and returned: 0</message> <message severity="info">. Remove 1 Package Installed size: 53 k Downloading Packages: Running Transaction Check Running Transaction Test Transaction Test Succeeded Running Transaction Erasing : 1:telnet-server fc16.x86_64 1/1 Verifying : 1:telnet-server fc16.x86_64 1/1 Removed: telnet-server.x86_64 1: fc16 </message>
25 REMEDIATION REVIEW Bash first Soon(ish), puppet Reference Šimon Lukašík s blog for a great write-up: Thank you Peter Vrabec & Martin Preisler for the work on OpenSCAP!
26 LIVE DEMO Patch & vuln. Scanning, configuration baseline scanning, Certification & Accreditation Paperwork Generation
27 ROADMAP Gov t Initiatives, SSG Packaging, Future Profiles
28 Government Initiatives Continuous Diagnostics and Mitigations (CDM) SCAP path forward Evaluation + Configuration activities for Certification and Accreditation
29 RPM Packaging Currently in EPEL, both Fedora and RHEL (thank you, Jan Lieskovsky!) SSG scheduled to ship in RHEL RHEL 7 GA
30 SCAP + Anaconda Integration <fix> elements targeting installation process Kickstart support allowing specification of SCAP content UI screen(s) that provide ways to set values Project started as Vratislav Podzimek s masters thesis (thanks, Vratislav!)
31 SCAP + Anaconda Integration ( 1 / 3)
32 SCAP + Anaconda Integration ( 2 / 3 )
33 SCAP + Anaconda Integration ( 3 / 3 )
34 SCAP Workbench GUI tool that serves as an SCAP scanner and provides tailoring functionality. Primary Goals: Lower the initial barrier of using SCAP. Great for hand-tuning content before enterprise deployment (e.g. via spacewalk/rhn Satellite)
35 SCAP Workbench ( 1 / 2 )
36 SCAP Workbench ( 2 / 2 )
37 37
38 SUPPLEMENTAL Helpful Links
39 Helpful Links (to community projects) SCAP Security Guide: OpenSCAP: OSCAP Anaconda: SCAP Workbench:
40 Helpful Links (to government baselines) DISA s Security Technical Implementation Guides (STIGs) NIST National Checklist Program Repository NSA Security Configuration Guides
41 Helpful Links (to communities of interest) Red Hat s Government Security User Group (gov-sec) Military Open Source Software (Mil-OSS)
42 Replicating the Demo - Assumes RHEL 6 and EPEL already enabled! - Assumes httpd installed, DocumentRoot /var/www/html/ - My IP was Change as appropriate. - This is meant to replicate the demo, not fully explain it. Come to Summit next year!
43 Step 1: Install $ yum install scap-security-guide $ rpm ql scap-security-guide... /usr/share/doc/scap-security-guide-0.1/rhel6-guide.html... /usr/share/man/en/man8/scap-security-guide.8.gz... /usr/share/xml/scap/ssg/content... /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml
44 Step 2: Review Prose Guide $ cp /usr/share/doc/scap-security-guide-0.1/*.html /var/www/html $ firefox - Review Check Procedure, Security Identifiers, References
45 Step 3: JBoss, too! $ firefox
46 Step 4: XCCDF vs DATASTREAMS $ grep "<Profile" /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml <Profile id="xccdf_org.ssgproject.content_profile_cs2 > <Profile id="xccdf_org.ssgproject.content_profile_stig-rhel6-server-upstream"> $ grep "<Profile" /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml <Profile id="cs2 > <Profile id="stig-rhel6-server-upstream >
47 Step 5: Run a scan! $ sudo oscap xccdf eval --profile C2S \ --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ --report /var/www/html/summit-report.html \ --results /var/www/html/summit-results.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml Console Output: Pass Fail notchecked : (a) not applicable; (b) no OVAL associated and unclear which reason!
48 Step 6: HTML Results $ firefox /var/www/html/summit-report.html
49 Step 6: HTML Results
50 Step 6: HTML Results
51 Step 7: XML Results $ firefox /var/www/html/summit-results.xml /CCE
52 Step 8: Remediation /CCE (ß type that again) note the <fix> tag!
53 Step 8: Remediation $ oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_c2s \ /var/www/html/summit-results.xml \ > /var/www/html/summit-script.sh.txt
June 8th, 2017 Washington D.C. Security Compliance for modern infrastructures with OpenSCAP
June 8th, 2017 Washington D.C. Security Compliance for modern infrastructures with OpenSCAP Martin Preisler Software Engineer at Red Hat, Inc. mpreisle@redhat.com SECURITY COMPLIANCE configuration hardening
Practical OpenSCAP, Security Standard Compliance and Reporting Part 1: CLI (command-line)
Presenters: Robin Price II and Martin Preisler Abstract: OpenSCAP is a family of open source SCAP tools and content that help users create standard security checklists for enterprise systems. Natively
Practical OpenSCAP Security Standard Compliance and Reporting. Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer
Practical OpenSCAP Security Standard Compliance and Reporting Robin Price II Senior Solutions Architect Martin Preisler Senior Software Engineer INTRODUCTION AGENDA Review some slides Follow along demostration
We have very limited time Won t cover extensive theory Won t cover writing SCAP policies - out of scope
GOALS 2 Hands on demos of real world use-cases Check software flaws - vulnerabilities Check configuration flaws - weaknesses Customizing existing security policies Put machines into compliance - remediate
UNCLASSIFIED. SCAP & STIG Workshop. Page 1 of 42 UNCLASSIFIED
SCAP & STIG Workshop Page 1 of 42 Table of Contents 1 INTRODUCTION... 4 2 SCAP SECURITY GUIDE PROJECT... 5 2.1 Background... 5 2.2 Project Charter...5 2.3 Installation...6 3 UNDERSTANDING THE COMPONENTS...7
SCAP Security Guide Questions / Answers. Contributor WorkShop Volume #2
SCAP Security Guide Questions / Answers Contributor WorkShop Volume #2 Ján Lieskovský January 2016 Agenda Introductory Notes Source Code / Repository Notes (Moved to Appendix for self-study) SCAP Security
A Security State of Mind: Container Security. Chris Van Tuin Chief Technologist, West
A Security State of Mind: Container Security Chris Van Tuin Chief Technologist, West cvantuin@redhat.com AGENDA Why Linux Containers? CONTAINER What are Linux Containers? APP LIBS Container Security HOST
SCAP Security Guide Questions / Answers. Ján Lieskovský Contributor WorkShop November 2015
SCAP Security Guide Questions / Answers Ján Lieskovský Contributor WorkShop November 2015 Agenda Introductory Notes SSG Repository Structure Contributing To SSG Developer Workflow Introductory Notes SCAP
FISMA COMPLIANCE FOR CONTAINERIZED APPS
FISMA COMPLIANCE FOR CONTAINERIZED APPS Using Atomic Scan and OpenSCAP with containers Jason Callaway Red Hat Principal Solutions Architect jcallawa@redhat.com @jasoncallaway jasoncallaway.com AGENDA Slides
Tenable SCAP Standards Declarations. June 4, 2015 (Revision 11)
Tenable SCAP Standards Declarations June 4, 2015 (Revision 11) Table of Contents Center for Internet Security (CIS)... 3 Common Criteria (NIAP)... 3 Common Vulnerability Enumeration (CVE)... 3 Common Configuration
S Automating security compliance for physical, virtual, cloud, and container environments
S103174 - Automating security compliance for physical, virtual, cloud, and container environments Using Red Hat CloudForms, Red Hat Satellite, Red Hat Insights and Ansible Tower by Red Hat Lucy Huh Kerner
Automating Security and Compliance for Hybrid Environments
Automating Security and Compliance for Hybrid Environments Lucy Kerner Security Global Technical Evangelist and Strategist, Red Hat lkerner@redhat.com @LucyCloudBling COMMON SECURITY CHALLENGES Inconsistent
L105190: Proactive Security Compliance Automation with CloudForms, Satellite, OpenSCAP, Insights, and Ansible Tower
L105190: Proactive Security Compliance Automation with CloudForms, Satellite, OpenSCAP, Insights, and Ansible Tower Lead Presenter: Lucy Kerner, Principal Technical Marketing Manager - Security, Red Hat
SecurityCenter 5.0 SCAP Assessments. May 28, 2015 (Revision 2)
SecurityCenter 5.0 SCAP Assessments May 28, 2015 (Revision 2) Table of Contents Overview... 3 Standards and Conventions... 3 Abbreviations... 3 Simple Assessment Procedure... 4 XCCDF Certified vs. Lower-Tier
Software Assurance Ecosystem Knowledge Architecture. 1 Wednesday, December 31, 2008
Software Assurance Ecosystem Knowledge Architecture 1 1 Wednesday, December 31, 2008 What Do The Building Blocks for Measuring Assurance Look Like? Standard ways for enumerating things we care about Languages/Formats
Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA
Operated by Los Alamos National Security, LLC for the U.S. Department of Energy's NNSA Jovial about Joval LANL s latest SCAP Adventure Angelo Ortiz May 22, 2018 Operated by Los Alamos National Security,
Red Hat Enterprise Linux 6 Security Feature Overview. Steve Grubb Principal Engineer, Red Hat June 23, 2010
Red Hat Enterprise Linux 6 Security Feature Overview Steve Grubb Principal Engineer, Red Hat June 23, 2010 Overview Minimal Platform Install Libcap-ng OpenSCAP FIPS-140 Stronger Hashes Common Criteria
Nessus v6 SCAP Assessments. November 18, 2014 (Revision 1)
Nessus v6 SCAP Assessments November 18, 2014 (Revision 1) Table of Contents Overview... 3 Standards and Conventions... 3 Abbreviations... 3 Simple Assessment Procedure... 3 XCCDF Certified vs. Lower-Tier
AUTOMATED PROCESSES IN COMPUTER SECURITY
AUTOMATED PROCESSES IN COMPUTER SECURITY Maroš Barabas Doctoral Degree Programme (3), FIT BUT E-mail: ibarabas@fit.vutbr.cz Supervised by: Petr Hanáček E-mail: hanacek@fit.vutbr.cz ABSTRACT This article
Providing Cybersecurity Inventory, Compliance Tracking, and C2 in a Heterogeneous Tool Environment
Providing Cybersecurity Inventory, Compliance Tracking, and C2 in a Heterogeneous Tool Environment Joseph L. Wolfkiel Secure Configuration Management Lead Engineer May 2018 1 Disclaimer The information
Current and Future Issues in Security
Current and Future Issues in Security Rick Therrien TAG-SS Co-chair (Incumbent) Operations Internal Revenue Service July 10, 2008 Infrastructure Security Goals Research emerging trends and requirements
The Center for Internet Security
The Center for Internet Security Measurably reducing risk through collaboration, consensus, & practical security management Content of this Presentation: I. Background II. Univ. of CA Schools Rights and
RED HAT ENTERPRISE LINUX 6 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW Version 1, Release 2. 3 June 2013
RED HAT ENTERPRISE LINUX 6 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW Version 1, Release 2 3 June 2013 Developed by Red Hat, NSA, and DISA for the DoD Trademark Information Names, products,
MIS Week 9 Host Hardening
MIS 5214 Week 9 Host Hardening Agenda NIST Risk Management Framework A quick review Implementing controls Host hardening Security configuration checklist (w/disa STIG Viewer) NIST 800-53Ar4 How Controls
MAKING SECURITY MEASURABLE AND MANAGEABLE
MAKING SECURITY MEASURABLE AND MANAGEABLE Robert A. Martin The MITRE Corporation Bedford, MA ABSTRACT The security and integrity of information systems is a critical issue within most types of organizations.
Tanium Comply User Guide. Version 1.7.3
Tanium Comply User Guide Version 1.7.3 August 21, 2018 The information in this document is subject to change without notice. Further, the information provided in this document is provided as is and is
AGENDA. 13:30-14:25 Gestion des patches, du provisionning et de la configuration de RHEL avec Satellite 6.1, par Michael Lessard, Red Hat
AGENDA 13:30-14:25 Gestion des patches, du provisionning et de la configuration de RHEL avec Satellite 6.1, par Michael Lessard, Red Hat 14:25-14:35 Capsule : Surveiller les accès aux fichiers avec Auditd,
A guide to managing hosts in a Red Hat Satellite 6 environment. Edition 1.0
Red Hat Satellite 6.2 Host Configuration Guide A guide to managing hosts in a Red Hat Satellite 6 environment. Edition 1.0 Last Updated: 2017-11-21 Red Hat Satellite 6.2 Host Configuration Guide A guide
Cyber Security Awareness for SmallSat Ground Networks
Cyber Security Awareness for SmallSat Ground Networks SSC16-IX-02 SmallSat 2016 Ted Vera Colorado Springs, CO (719) 598-2801 Denver, CO (303) 703-3834 Chantilly, VA (703) 488-2500 http://www.rtlogic.com
Thinking the Open Source way
Thinking the Open Source way Matt Jamison Sr. Gov t Solutions Architect MSgt, USAFR jamo@redhat.com Source code: #include int main (void) { printf("hello, world!\n"); return 0; } Binary code:
Defense Security Service Industrial Security Field Operations National Industrial Security Program (NISP) Authorization Office (NAO)
Defense Security Service Industrial Security Field Operations National Industrial Security Program (NISP) Authorization Office (NAO) Getting Started with the SCAP Compliance Checker and STIG Viewer Job
Red Hat Satellite Server 6.2 Pattern
Red Hat Satellite Server 6.2 Pattern Table of contents Overview What is a Satellite Server? Why did we need a new Satellite Server 6.2 pattern? Architecture High Level Red Hat Satellite 6 System Architecture
HOW TO MAKE THE CASE TO MANAGEMENT: PAYING FOR OPEN SOURCE
HOW TO MAKE THE CASE TO MANAGEMENT: PAYING FOR OPEN SOURCE The Value of a Red Hat Subscription Jennifer LuPiba Principal Product Marketing Manager, Red Hat Enterprise Linux May 9, 2018 WHY ARE WE PAYING
Secure Configuration Manager SCAP Module User's Guide. January 2018
Secure Configuration Manager SCAP Module User's Guide January 2018 Legal Notice For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government
Red Hat Enterprise Linux 6.4 Security-enhanced. Linux User Guide >>>CLICK HERE<<<
Red Hat Enterprise Linux 6.4 Securityenhanced Linux User Guide New and Changed Features for Red Hat Enterprise Linux 6.4. 1.1.6. New and Changed SELinux: Avoid SELinux on GFS2. 2.5.5. Setting Up NFS Over.
Securing DevOps, RMF and STIG
Securing DevOps, RMF and STIG Scott Snowden Sameer Kamani May 2017 San Diego Federal Fortify Users Group DevOps definition and principles DevOps (a clipped compound of development and operations) is a
Improving FISMA Effectiveness and Efficiency Through the Security Content Automation Program (SCAP)
Improving FISMA Effectiveness and Efficiency Through the Security Content Automation Program (SCAP) Shared Interest Group (SIG): Security and Privacy Date Released: January 28, 2008 The following White
Joint System Administrator Checklist Version December 2005
Joint System Administrator Checklist Version 1.1 22 December 2005 Daily Review Audit logs Check application log for warning and error messages for service startup errors, application or database errors
Container Deployment and Security Best Practices
Container Deployment and Security Best Practices How organizations are leveraging OpenShift, Quay, and Twistlock to deploy, manage, and secure a cloud native environment. John Morello CTO Twistlock Dirk
Red Hat Cloud security: Frameworks & enforcement. Kurt Seifried Security Response team April 16, 2014 v1.0
Red Hat Cloud security: Frameworks & enforcement Kurt Seifried Security Response team April 16, 2014 v1.0 Agenda A quick history of the future Cloud IT and Security it's all about operations Cloud security
Contents User Guide... 1 Overview... 1 Create a New Report... 3 Create Report... 3 Select Devices... 3 Report Generation... 4 Your Audit Report...
User Guide Version 3.4 (Paws Studio 3.0.0) Titania Limited 2015. All Rights Reserved This document is intended to provide advice and assistance for the installation and running of Paws Studio. While Titania
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 2 OF 3 ABSTRACT This white paper is Part 2 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring
Put Security Into Your DevOps NOW. Or Prepare for the Flood Matthew Fisher Solution Architect, Fortify Federal 08MAR2018
Put Security Into Your DevOps NOW Or Prepare for the Flood Matthew Fisher Solution Architect, Fortify Federal 08MAR2018 Defining Devops State of Devops Report (Puppet, Dora):..set of practices and cultural
Red Hat CloudForms 4.6
Red Hat CloudForms 4.6 Scanning Container Images in CloudForms with OpenSCAP Configuring OpenSCAP in CloudForms for Scanning Container Images Last Updated: 2018-05-24 Red Hat CloudForms 4.6 Scanning Container
CSAM Support for C&A Transformation
CSAM Support for C&A Transformation Cyber Security Assessment and Management (CSAM) 1 2 3 4 5 Five Services, One Complete C&A Solution Mission/Risk-Based Policy & Implementation/Test Guidance Program Management
CREATING A CLOUD STRONGHOLD: Strategies and Methods to Manage and Secure Your Cloud
CREATING A CLOUD STRONGHOLD: Strategies and Methods to Manage and Secure Your Cloud Ted Brunell Principal Solution Architect, DoD Programs tbrunell@redhat.com @DoDCloudGuy AGENDA Overview of Current Security
Tenable Network Security Support Portal. November 9, 2010 (Revision 8)
Tenable Network Security Support Portal November 9, 2010 (Revision 8) Table of Contents TABLE OF CONTENTS... 2 INTRODUCTION... 3 OBTAINING ACCESS TO THE TENABLE SUPPORT PORTAL... 3 MANAGING YOUR NESSUS
Upgrade Guide. Upgrading to EventTracker v7.1 Enterprise. Upgrade Guide Centre Park Drive Publication Date: Apr 11, 2011.
Upgrading to EventTracker v7.1 Enterprise Upgrade Guide 8815 Centre Park Drive Publication Date: Apr 11, 2011 Columbia MD 21045 U.S. Toll Free: 877.333.1433 Abstract The purpose of this document is to
Summit Days. Structure and numbering of JVN, and Security content automation framework. Future of Global Vulnerability Reporting Summit
Future of Global Vulnerability Reporting Summit Summit Days Structure and numbering of JVN, and Security content automation framework November 14, 2012 Masato Terada IT Security Center, IPA FIRST TC @
INFORMATION ASSURANCE DIRECTORATE
National Security Agency/Central Security Service INFORMATION ASSURANCE DIRECTORATE CGS Vulnerability Vulnerability Assessment is the systematic examination of an Enterprise to determine the adequacy of
Security Automation Developer Days Winter 2010 Conference Preliminary High Level Agenda
Security Automation Developer Days Winter 2010 Conference Preliminary High Level Agenda Dates: Monday, February 22, 2010 thru Wednesday, February 24, 2010 Location: NIST, Gaithersburg Campus, Building
Agenda 1 Types of VMware Tools 2 Status Display in vsphere 3 Lifecycle and Supported Guests 4 Standardization Approach 5 Keeping Tools Updated #SER195
SER1957BU Mastering the VMware Tools Lifecycle in Your vsphere Data Center Eric Gray #VMworld #SER1957BU Agenda 1 Types of VMware Tools 2 Status Display in vsphere 3 Lifecycle and Supported Guests 4 Standardization
CT 320: Network and System Administration
CT 320: Network and System Administration CHAPTER 12: SOFTWARE INSTALLATION COLORADO STATE UNIVERSITY COMPUTER SCIENCE DEPARTMENT CHRIS WILCOX FALL 2012 1 Topics 1. The Problem of Software Installation
ForeScout Extended Module for Advanced Compliance
ForeScout Extended Module for Advanced Compliance Version 1.2 Table of Contents About Advanced Compliance Integration... 4 Use Cases... 4 Additional Documentation... 6 About This Module... 6 About Support
Red Hat OpenShift Roadmap Q4 CY16 and H1 CY17 Releases. Lutz Lange Solution
Red Hat OpenShift Roadmap Q4 CY16 and H1 CY17 Releases Lutz Lange Solution Architect @AtomicContainer OpenShift Roadmap OpenShift Container Platform 3.2 Kubernetes 1.2 & Docker 1.9
What s New in Gerrit 2.14 Gerrit User Summit London 2017
What s New in Gerrit 2.14 Gerrit User Summit London 2017 David Pursehouse CollabNet Summary of New Features Assignee field for changes Deletable changes Improved reviewer suggestion Email: new templates,
IBM Endpoint Manager for Configuration Management User's Guide
IBM Endpoint Manager for Configuration Management User's Guide ii IBM Endpoint Manager for Configuration Management User's Guide Contents Configuration Management User's Guide 1 Setting up Configuration
DATABASE SECURITY REQUIREMENTS GUIDE (SRG) TECHNOLOGY OVERVIEW. Version 2, Release October Developed by DISA for the DoD
DATABASE SECURITY REQUIREMENTS GUIDE (SRG) TECHNOLOGY OVERVIEW Version 2, Release 5 28 October 2016 Developed by for the DoD 28 October 2016 Developed by for the DoD Trademark Information Names, products,
Case Study: The Evolution of EMC s Product Security Office. Dan Reddy, CISSP, CSSLP EMC Product Security Office
Case Study: The Evolution of EMC s Product Security Office Dan Reddy, CISSP, CSSLP EMC Product Security Office 1 The Evolution of EMC Product Security 2000-2004 2005-2009 2010-Beyond External Drivers Hackers
Quick Prototyping+CI with LXC and Puppet
Quick Prototyping+CI with LXC and Puppet Ben Kero 2014-05-04 Introduction Ben Kero Release Engineer Responsible for version control systems: CVS, SVN, BZR, Darcs, RCS, Git, Mercurial Before at Mozilla
IBM BigFix Version 9.5. Patch for Red Hat Enterprise Linux User's Guide IBM
IBM BigFix Version 9.5 Patch for Red Hat Enterprise Linux User's Guide IBM IBM BigFix Version 9.5 Patch for Red Hat Enterprise Linux User's Guide IBM Note Before using this information and the product
Affordable Security. Sarah Pramanik April 10, 2013
Affordable Security Sarah Pramanik April 10, 2013 It s a Balancing Act Affordability Security 2 Overview Defining Cyber Security Defense in Depth Program Risk vs. Security Risk Life Cycle Phases Pre-proposal/Proposal
Using Splunk to Assess and Implement Critical Security Control #3
Using Splunk to Assess and Implement Critical Security Control #3 Disclaimer During the course of this presentation, we may make forward looking statements regarding future events or the expected performance
A DEVOPS STATE OF MIND WITH DOCKER AND KUBERNETES. Chris Van Tuin Chief Technologist, West
A DEVOPS STATE OF MIND WITH DOCKER AND KUBERNETES Chris Van Tuin Chief Technologist, West cvantuin@redhat.com Open Source V In short, software is eating the world. - Marc Andreessen, Wall Street Journal,
Use Software Collections for PHP 5.6 support on RHEL and CentOS 6 and 7
Use Software Collections for PHP 5.6 support on RHEL and CentOS 6 and 7 Introduction Audience Disclaimer Software Collections and PHP Installation Install MySQL Enable Software Collections Add repositories
RED HAT INSIGHTS. Security & Proactive Response with Insights
RED HAT INSIGHTS Security & Proactive Response with Insights William Nix Principal Technical Marketing Manager Management Business Unit, Red Hat Insights WHY WE BUILT A NEW PRODUCT SECURITY IS RISK MANAGEMENT
Red Hat Containers Roadmap. Red Hat A panel of product directors
Red Hat Containers Roadmap Red Hat A panel of product directors Joe Fernandes Sr. Director Product Mgmt, Red Hat Rich Sharples Sr. Director of Product Mgmt, Red Hat Sayan Saha Sr. Manager of Product Mgmt,
BigFix 2018 Roadmap. Aram Eblighatian. Product Manager IBM BigFix. 14 May, 2018
BigFix 2018 Roadmap Aram Eblighatian Product Manager IBM BigFix 14 May, 2018 What's New in BigFix? BigFix Platform BigFix Platform v9.5.7 Released Oct. 2017 Gathering Performance improvements (WebUI and
ConfigOS. Concept of Operations. Automated STIG Remediation Making Software Work in Secure Environments. Version 1.7.
ConfigOS Concept of Operations Automated STIG Remediation Making Software Work in Secure Environments Version 1.7 February 31, 2015 Copyright 2015 SteelCloud LLC www.steelcloud.com 20110 Ashbrook Place,
PROFESSIONAL SERVICES (Solution Brief)
(Solution Brief) The most effective way for organizations to reduce the cost of maintaining enterprise security and improve security postures is to automate and optimize information security. Vanguard
Interface reference. McAfee Policy Auditor Interface Reference Guide. Add Service Level Agreement page
McAfee Policy Auditor 6.4.0 Interface Reference Guide (McAfee epolicy Orchestrator) Interface reference Add Service Level Agreement page Use this page to add Service Level Agreements. Service Level Agreements
Continuous Diagnostics and Mitigation demands, CyberScope and beyond
Continuous Diagnostics and Mitigation demands, CyberScope and beyond IBM BigFix streamlines federal security compliance with real-time insights and remediation Highlights Meet Continuous Diagnostics and
Risk Management Framework (RMF) 101 for Managers. October 17, 2017
Risk Management Framework (RMF) 101 for Managers October 17, 2017 DoD Risk Management Framework (RMF) Process DoDI 8510.01, Mar 2014 [based on NIST SP 800-37] Architecture Description Components Firmware
Meeting RMF Requirements around Compliance Monitoring
Meeting RMF Requirements around Compliance Monitoring An EiQ Networks White Paper Meeting RMF Requirements around Compliance Monitoring Purpose The purpose of this paper is to provide some background on
IBM BigFix Compliance PCI Add-on Version 9.5. Payment Card Industry Data Security Standard (PCI DSS) User's Guide IBM
IBM BigFix Compliance PCI Add-on Version 9.5 Payment Card Industry Data Security Standard (PCI DSS) User's Guide IBM IBM BigFix Compliance PCI Add-on Version 9.5 Payment Card Industry Data Security Standard
DATA SHEET. ez/piv CARD KEY FEATURES:
Personal Identity Verification (PIV) Card ez/piv Card satisfies FIPS 201, HSPD-12. It allows your users to authenticate to z/os Security Server through the use of a government PIV or CAC Card. KEY FEATURES:
Flush Dns Settings Linux Redhat 5 Step Step
Flush Dns Settings Linux Redhat 5 Step Step Setup Cahing DNS Server in RHEL/CentOS 7. DNS cache servers are used to resolve any DNS query they receive. Operating System : CentOS Linux release 7.0.1406
Risk Management Framework for DoD Medical Devices
Risk Management Framework for DoD Medical Devices Session 136, March 7, 2018 Lt. Col. Alan Hardman, Chief Operations Officer, Cyber Security Division, Office of the DAD IO/J-6 William Martin, Deputy of
RED HAT DEVELOPER TOOLSET: Build, Run, & Analyze Applications On Multiple Versions of Red Hat Enterprise Linux
RED HAT DEVELOPER TOOLSET: Build, Run, & Analyze Applications On Multiple Versions of Red Hat Enterprise Linux Dr. Matt Newsome Engineering Manager Tools 13/JUN/13 v0.8 -> Introduction Dr. Matt Newsome
Product Support Notice
PSN # PSN020361u Product Support Notice 2018 Avaya Inc. All Rights Reserved. Avaya Proprietary Use pursuant to the terms of your signed agreement or company policy. Original publication date: 11-Oct-18.
Total Protection for Compliance: Unified IT Policy Auditing
Total Protection for Compliance: Unified IT Policy Auditing McAfee Total Protection for Compliance Regulations and standards are growing in number, and IT audits are increasing in complexity and cost.
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense. Christian Espinosa Alpine Security
Top 20 Critical Security Controls (CSC) for Effective Cyber Defense Christian Espinosa Alpine Security christian.espinosa@alpinesecurity.com Background Christian Espinosa christian.espinosa@alpinesecurity.com
DoD ANNEX FOR PROTECTION PROFILE FOR APPLICATION SOFTWARE V1.2. Version 1, Release February Developed by DISA for the DoD
DoD ANNEX FOR PROTECTION PROFILE FOR APPLICATION SOFTWARE V1.2 Version 1, Release 1 21 February 2018 Developed by for the DoD 21 February 2018 Developed by for the DoD Trademark Information Names, products,
Automated Cyber Hardening of Mission Management Systems
Automated Cyber Hardening of Mission Management Systems Raytheon IIS Austin Garrett & Mike Worden January 9, 2018 Copyright 2017 Raytheon Company. All rights reserved. Published by The Aerospace Corporation
Red Hat Quay 2.9 Deploy Red Hat Quay - Basic
Red Hat Quay 2.9 Deploy Red Hat Quay - Basic Deploy Red Hat Quay Last Updated: 2018-09-14 Red Hat Quay 2.9 Deploy Red Hat Quay - Basic Deploy Red Hat Quay Legal Notice Copyright 2018 Red Hat, Inc. The
RISK MANAGEMENT FRAMEWORK COURSE
RISK MANAGEMENT FRAMEWORK COURSE Secure Managed Instructional Systems, LLC Consulting Training Staffing Support 3350 Riverview Pkwy Suite 1900 * Atlanta, Georgia 30339 * Phone: 800-497-3376 * Email: semais@semais.net.*
Parallels Virtuozzo Containers
Parallels Virtuozzo Containers White Paper More Efficient Virtualization Management: Templates www.parallels.com Version 2.0 Table of Contents Table of Contents... 2 OS, Middleware or VM Sprawl... 3 Why
Red Hat Insights Mitigate Risk & Proactively Manage Your Infrastructure
Red Hat Insights Mitigate Risk & Proactively Manage Your Infrastructure William Nix Technical Product Marketing Manager Red Hat Management Business Unit Will Nix @ Red Hat Public Sector Information Systems
Red Hat Enterprise Linux MRG Red Hat Network Satellite Red Hat Enterprise Virtualization JBoss Cloud
1 Red Hat Enterprise Linux MRG Red Hat Satellite Red Hat Enterprise Virtualization JBoss Cloud 2 Red Hat Enterprise Linux 3 Proven development model Red Hat collaborates with the open source community
Federal Continuous Monitoring Working Group. March 21, DOJ Cybersecurity Conference 2/8/2011
Federal Continuous Monitoring Working Group March 21, 2011 DOJ Cybersecurity Conference 2/8/2011 4/12/2011 Why Continuous Monitoring? Case for Change Strategy Future State Current State Current State Case
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 1 OF 3
WHITE PAPER CONTINUOUS MONITORING INTRODUCTION & CONSIDERATIONS PART 1 OF 3 ABSTRACT This white paper is Part 1 in a three-part series of white papers on the sometimes daunting subject of continuous monitoring
Suman Sourav Director DevSecOps, Vantage Point Security. OWASP Indonesia Day 2017
Suman Sourav Director DevSecOps, Vantage Point Security OWASP Indonesia Day 2017 About me Certified Secure Software Lifecycle Professional (CSSLP) 12+ Years of Experience in Software Security Co-Founder
MICROSOFT SQL SERVER 2016 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW. Version 1, Release March 2018
MICROSOFT SQL SERVER 2016 SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW Version 1, Release 1 09 March 2018 Developed by Microsoft and for the DoD Trademark Information Names, products, and services
RHEV in the weeds - special sauce! Marc Skinner
RHEV in the weeds - special sauce! Marc Skinner Twin Cities Users Group :: Q3/2013 Introduction RHEV = Red Hat Enterprise Vitualization RHEV Manager = Red Hat Enterprise Hypervisor Manager DATACENTER VIRTUALIZATION
Release Notes: J-Web Application Package Release 15.1A4 for Juniper Networks EX Series Ethernet Switches
Release Notes: J-Web Application Package Release 15.1A4 for Juniper Networks EX Series Ethernet Switches Release 15.1A4 July 2018 Revision 1 Contents Release Notes: J-Web Application Package Release 15.1A4
Security Automation Developer Days July 9-13, 2012
Monday July 9 th 2012 10:00-10:10 Welcome Introduce the organizers of the event and the major players; describe MITRE s role for the event; and describe the goals for this event. 10:10 12:00 CCE David
MICROSOFT (MS) WINDOWS DEFENDER ANTIVIRUS SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW. Version 1, Release 4 27 APRIL 2018
MICROSOFT (MS) WINDOWS DEFENDER ANTIVIRUS SECURITY TECHNICAL IMPLEMENTATION GUIDE (STIG) OVERVIEW Version 1, Release 4 27 APRIL 2018 Developed by for the DoD Trademark Information Names, products, and
Jenkins User Conference Israel. #jenkinsconf. CI / Liveperson. Gidi Samuels. July 16, #jenkinsconf
Jenkins User Conference Israel #jenkinsconf CI / CD @ Liveperson Gidi Samuels www.liveperson.com July 16, 2014 #jenkinsconf About Myself Lead the CI Team at Liveperson 3 years in Liveperson About Myself
Automating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
Ensuring System Protection throughout the Operational Lifecycle
Ensuring System Protection throughout the Operational Lifecycle The global cyber landscape is currently occupied with a diversity of security threats, from novice attackers running pre-packaged distributed-denial-of-service