table of contents
- NAME
- DESCRIPTION
- Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7
- Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8
- Profiles in Guide to the Secure Configuration of EuroLinux 8
- Profiles in Guide to the Secure Configuration of Firefox
- Profiles in Guide to the Secure Configuration of Java Runtime Environment
- Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7
- Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8
- Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7
- EXAMPLES
- FILES
- DEPLOYMENT TO U.S. CIVILIAN GOVERNMENT SYSTEMS
- DEPLOYMENT TO U.S. MILITARY SYSTEMS
- SEE ALSO
- AUTHOR
| scap-security-guide(8) | System Manager's Manual | scap-security-guide(8) |
NAME¶
SCAP-Security-Guide - Delivers security guidance, baselines, and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP).
DESCRIPTION¶
The project provides practical security hardening advice and also links it to compliance requirements in order to ease deployment activities, such as certification and accreditation. These include requirements in the U.S. government (Federal, Defense, and Intelligence Community) as well as of the financial services and health care industries. For example, high-level and widely-accepted policies such as NIST 800-53 provides prose stating that System Administrators must audit "privileged user actions," but do not define what "privileged actions" are. The SSG bridges the gap between generalized policy requirements and specific implementation guidance, in SCAP formats to support automation whenever possible.
The projects homepage is located at: https://www.open-scap.org/security-policies/scap-security-guide
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7¶
Source Datastream: ssg-centos7-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 7 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
Standard System Security Profile for Red Hat Enterprise Linux 7
This profile contains rules to ensure standard security baseline of a Red Hat Enterprise Linux 7 system. Regardless of your system's workload all of these checks should pass.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8¶
Source Datastream: ssg-centos8-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 8 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (high)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (intermediary)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (minimal)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
From NIST 800-171, Section 2.2: Security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 8 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
Australian Cyber Security Centre (ACSC) Essential Eight
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 8 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
Australian Cyber Security Centre (ACSC) ISM Official
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL.
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Protection Profile for General Purpose Operating Systems
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems.
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
DISA STIG for Red Hat Enterprise Linux 8
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V1R7.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
DISA STIG with GUI for Red Hat Enterprise Linux 8
This profile contains configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux 8 V1R7.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 8 profile.
Profiles in Guide to the Secure Configuration of EuroLinux 8¶
Source Datastream: ssg-eurolinux8-ds.xml
The Guide to the Secure Configuration of EuroLinux 8 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (high)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (intermediary)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (minimal)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server - adapted for EuroLinux 8
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v1.0.1, released 2021-05-19.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server - adapted for EuroLinux 8
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v1.0.1, released 2021-05-19.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation - adapted for EuroLinux 8
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v1.0.1, released 2021-05-19.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation - adapted for EuroLinux 8
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v1.0.1, released 2021-05-19.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
From NIST 800-171, Section 2.2: Security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 8 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
Australian Cyber Security Centre (ACSC) Essential Eight
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 8 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
Australian Cyber Security Centre (ACSC) ISM Official
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL.
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Protection Profile for General Purpose Operating Systems
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems.
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8 - adapted for EuroLinux 8
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
DISA STIG for Red Hat Enterprise Linux 8 - adapted for EuroLinux 8
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V1R5.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
DISA STIG with GUI for Red Hat Enterprise Linux 8 - adapted for EuroLinux 8
This profile contains configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux 8 V1R5.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 8 profile.
Profiles in Guide to the Secure Configuration of Firefox¶
Source Datastream: ssg-firefox-ds.xml
The Guide to the Secure Configuration of Firefox is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
Upstream Firefox STIG
This profile is developed under the DoD consensus model and DISA FSO Vendor STIG process, serving as the upstream development environment for the Firefox STIG.
As a result of the upstream/downstream relationship between the SCAP Security Guide project and the official DISA FSO STIG baseline, users should expect variance between SSG and DISA FSO content. For official DISA FSO STIG content, refer to https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=app-security%2Cbrowser-guidance.
While this profile is packaged by Red Hat as part of the SCAP Security Guide package, please note that commercial support of this SCAP content is NOT available. This profile is provided as example SCAP content with no endorsement for suitability or production readiness. Support for this profile is provided by the upstream SCAP Security Guide community on a best-effort basis. The upstream project homepage is https://www.open-scap.org/security-policies/scap-security-guide/.
Profiles in Guide to the Secure Configuration of Java Runtime Environment¶
Source Datastream: ssg-jre-ds.xml
The Guide to the Secure Configuration of Java Runtime Environment is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
Java Runtime Environment (JRE) STIG
The Java Runtime Environment (JRE) is a bundle developed and offered by Oracle Corporation which includes the Java Virtual Machine (JVM), class libraries, and other components necessary to run Java applications and applets. Certain default settings within the JRE pose a security risk so it is necessary to deploy system wide properties to ensure a higher degree of security when utilizing the JRE.
The IBM Corporation also develops and bundles the Java Runtime Environment (JRE) as well as Red Hat with OpenJDK.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7¶
Source Datastream: ssg-rhel7-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 7 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
C2S for Red Hat Enterprise Linux 7
This profile demonstrates compliance against the U.S. Government Commercial Cloud Services (C2S) baseline.
This baseline was inspired by the Center for Internet Security (CIS) Red Hat Enterprise Linux 7 Benchmark, v2.1.1 - 01-31-2017.
For the SCAP Security Guide project to remain in compliance with CIS' terms and conditions, specifically Restrictions(8), note there is no representation or claim that the C2S profile will ensure a system is in compliance or consistency with the CIS baseline.
ANSSI-BP-028 (enhanced)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (high)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (intermediary)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (minimal)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
CIS Red Hat Enterprise Linux 7 Benchmark for Level 2 - Server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v3.1.1, released 05-21-2021.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 7 Benchmark for Level 1 - Server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v3.1.1, released 05-21-2021.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 7 Benchmark for Level 1 - Workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v3.1.1, released 05-21-2021.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 7 Benchmark for Level 2 - Workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 7 Benchmark™, v3.1.1, released 05-21-2021.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 7 CIS Benchmarks™ content.
Criminal Justice Information Services (CJIS) Security Policy
This profile is derived from FBI's CJIS v5.4 Security Policy. A copy of this policy can be found at the CJIS Security Policy Resource Center:
https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center
Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
From NIST 800-171, Section 2.2: Security requirements for protecting the confidentiality of CUI in non-federal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 7 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI).
Australian Cyber Security Centre (ACSC) Essential Eight
This profile contains configuration checks for Red Hat Enterprise Linux 7 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 7 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
NIST National Checklist Program Security Guide
This compliance profile reflects the core set of security related configuration settings for deployment of Red Hat Enterprise Linux 7.x into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- Committee on National Security Systems Instruction No. 1253 (CNSSI 1253) - NIST Controlled Unclassified Information (NIST 800-171) - NIST 800-53 control selections for MODERATE impact systems (NIST 800-53) - U.S. Government Configuration Baseline (USGCB) - NIAP Protection Profile for General Purpose Operating Systems v4.2.1 (OSPP v4.2.1) - DISA Operating System Security Requirements Guide (OS SRG)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the OpenSCAP/SCAP Security Guide initiative, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors OpenSCAP/SCAP Security Guide content as minor divergences, such as bugfixes, work through the consensus and release processes.
OSPP - Protection Profile for General Purpose Operating Systems v4.2.1
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems.
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
RHV hardening based on STIG for Red Hat Enterprise Linux 7
This profile contains configuration checks for Red Hat Virtualization based on the the DISA STIG for Red Hat Enterprise Linux 7.
VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Virtualization
This compliance profile reflects the core set of security related configuration settings for deployment of Red Hat Enterprise Linux Hypervisor (RHELH) 7.x into U.S. Defense, Intelligence, and Civilian agencies. Development partners and sponsors include the U.S. National Institute of Standards and Technology (NIST), U.S. Department of Defense, the National Security Agency, and Red Hat.
This baseline implements configuration requirements from the following sources:
- Committee on National Security Systems Instruction No. 1253 (CNSSI 1253) - NIST 800-53 control selections for MODERATE impact systems (NIST 800-53) - U.S. Government Configuration Baseline (USGCB) - NIAP Protection Profile for Virtualization v1.0 (VPP v1.0)
For any differing configuration requirements, e.g. password lengths, the stricter security setting was chosen. Security Requirement Traceability Guides (RTMs) and sample System Security Configuration Guides are provided via the scap-security-guide-docs package.
This profile reflects U.S. Government consensus content and is developed through the ComplianceAsCode project, championed by the National Security Agency. Except for differences in formatting to accommodate publishing processes, this profile mirrors ComplianceAsCode content as minor divergences, such as bugfixes, work through the consensus and release processes.
Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)
This profile contains the minimum security relevant configuration settings recommended by Red Hat, Inc for Red Hat Enterprise Linux 7 instances deployed by Red Hat Certified Cloud Providers.
Standard System Security Profile for Red Hat Enterprise Linux 7
This profile contains rules to ensure standard security baseline of a Red Hat Enterprise Linux 7 system. Regardless of your system's workload all of these checks should pass.
DISA STIG for Red Hat Enterprise Linux 7
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux V3R7.
In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 7, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 7 image
DISA STIG with GUI for Red Hat Enterprise Linux 7
This profile contains configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux V3R7.
In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 7, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 7 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 7 profile.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 8¶
Source Datastream: ssg-rhel8-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 8 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (high)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (intermediary)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
ANSSI-BP-028 (minimal)
This profile contains configurations that align to ANSSI-BP-028 v1.2 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server
This profile defines a baseline that aligns to the "Level 2 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server
This profile defines a baseline that aligns to the "Level 1 - Server" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation
This profile defines a baseline that aligns to the "Level 1 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
CIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation
This profile defines a baseline that aligns to the "Level 2 - Workstation" configuration from the Center for Internet Security® Red Hat Enterprise Linux 8 Benchmark™, v2.0.0, released 2022-02-23.
This profile includes Center for Internet Security® Red Hat Enterprise Linux 8 CIS Benchmarks™ content.
Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
From NIST 800-171, Section 2.2: Security requirements for protecting the confidentiality of CUI in nonfederal information systems and organizations have a well-defined structure that consists of:
(i) a basic security requirements section; (ii) a derived security requirements section.
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems. The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication 800-53.
This profile configures Red Hat Enterprise Linux 8 to the NIST Special Publication 800-53 controls identified for securing Controlled Unclassified Information (CUI)."
Australian Cyber Security Centre (ACSC) Essential Eight
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
The HIPAA Security Rule establishes U.S. national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This profile configures Red Hat Enterprise Linux 8 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
Australian Cyber Security Centre (ACSC) ISM Official
This profile contains configuration checks for Red Hat Enterprise Linux 8 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) with the applicability marking of OFFICIAL.
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation's security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Protection Profile for General Purpose Operating Systems
This profile reflects mandatory configuration controls identified in the NIAP Configuration Annex to the Protection Profile for General Purpose Operating Systems (Protection Profile Version 4.2.1).
This configuration profile is consistent with CNSSI-1253, which requires U.S. National Security Systems to adhere to certain configuration parameters. Accordingly, this configuration profile is suitable for use in U.S. National Security Systems.
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
DISA STIG for Red Hat Enterprise Linux 8
This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V1R7.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
DISA STIG with GUI for Red Hat Enterprise Linux 8
This profile contains configuration checks that align to the DISA STIG with GUI for Red Hat Enterprise Linux 8 V1R7.
In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this configuration baseline as applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
- Red Hat Enterprise Linux Server - Red Hat Enterprise Linux Workstation and Desktop - Red Hat Enterprise Linux for HPC - Red Hat Storage - Red Hat Containers with a Red Hat Enterprise Linux 8 image
Warning: The installation and use of a Graphical User Interface (GUI) increases your attack vector and decreases your overall security posture. If your Information Systems Security Officer (ISSO) lacks a documented operational requirement for a graphical user interface, please consider using the standard DISA STIG for Red Hat Enterprise Linux 8 profile.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 7¶
Source Datastream: ssg-sl7-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 7 is broken into 'profiles', groupings of security settings that correlate to a known policy. Available profiles are:
PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Ensures PCI-DSS v3.2.1 security configuration settings are applied.
Standard System Security Profile for Red Hat Enterprise Linux 7
This profile contains rules to ensure standard security baseline of a Red Hat Enterprise Linux 7 system. Regardless of your system's workload all of these checks should pass.
EXAMPLES¶
To scan your system utilizing the OpenSCAP utility against the ospp profile:
oscap xccdf eval --profile ospp --results /tmp/`hostname`-ssg-results.xml --report /tmp/`hostname`-ssg-results.html --oval-results /usr/share/xml/scap/ssg/content/ssg-{product}-xccdf.xml
Additional details can be found on the projects wiki page: https://www.github.com/ComplianceAsCode/content/wiki
FILES¶
/usr/share/xml/scap/ssg/content
SCAP Source Datastreams: ssg-{product}-ds.xml
CPE Dictionaries: ssg-{product}-cpe-dictionary.xml
CPE OVAL Content: ssg-{product}-cpe-oval.xml
OVAL Content: ssg-{product}-oval.xml
XCCDF Content: ssg-{product}-xccdf.xml
/usr/share/doc/scap-security-guide/guides/
/usr/share/scap-security-guide/ansible/
/usr/share/scap-security-guide/bash/
DEPLOYMENT TO U.S. CIVILIAN GOVERNMENT SYSTEMS¶
SCAP Security Guide content is considered vendor (Red Hat) provided content. Per guidance from the U.S. National Institute of Standards and Technology (NIST), U.S. Government programs are allowed to use Vendor produced SCAP content in absence of "Governmental Authority" checklists. The specific NIST verbage: http://web.nvd.nist.gov/view/ncp/repository/glossary?cid=1#Authority
DEPLOYMENT TO U.S. MILITARY SYSTEMS¶
DoD Directive (DoDD) 8500.1 requires that "all IA and IA-enabled IT products incorporated into DoD information systems shall be configured in accordance with DoD-approved security configuration guidelines" and tasks Defense Information Systems Agency (DISA) to "develop and provide security configuration guidance for IA and IA-enabled IT products in coordination with Director, NSA." The output of this authority is the DISA Security Technical Implementation Guides, or STIGs. DISA FSO is in the process of moving the STIGs towards the use of the NIST Security Content Automation Protocol (SCAP) in order to "automate" compliance reporting of the STIGs.
Through a common, shared vision, the SCAP Security Guide community enjoys close collaboration directly with NSA, NIST, and DISA FSO. As stated in Section 1.1 of the Red Hat Enterprise Linux 6 STIG Overview, Version 1, Release 2, issued on 03-JUNE-2013:
"The consensus content was developed using an open-source project called SCAP Security Guide. The project's website is https://www.open-scap.org/security-policies/scap-security-guide. Except for differences in formatting to accommodate the DISA STIG publishing process, the content of the Red Hat Enterprise Linux 6 STIG should mirror the SCAP Security Guide content with only minor divergence as updates from multiple sources work through the consensus process."
The DoD STIG for Red Hat Enterprise Linux 7, revision V2R4, was released in July 2019 Currently, the DoD Red Hat Enterprise Linux 7 STIG contains only XCCDF content and is available online: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux
Content published against the public.cyber.mil website is authoritative STIG content. The SCAP Security Guide project, as noted in the STIG overview, is considered upstream content. Unlike DISA FSO, the SCAP Security Guide project does publish OVAL automation content. Individual programs and C&A evaluators make program-level determinations on the direct usage of the SCAP Security Guide. Currently there is no blanket approval.
SEE ALSO¶
AUTHOR¶
Please direct all questions to the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
| 26 Jan 2013 | version 1 |