Could OpenSCAP STIG rules feed into e.g. covered_by

[openprivacy]

[assuming covered_by is for test results/justifications. If not, replace with appropriate key]

I'm building a set of RHEL/7 instances and am starting to look at compliance-masonry to help with document creation and gap analysis - and possibly as a controller to run tests. I'm currently using the OpenSCAP tool for OS compliance verification, and each of the 800-53 controls has one or more STIG rules to check compliance. Things get complicated quickly:

• There may be seven STIG rules for a control of which only five pass (gap of two)
• Even if all pass, that's just the OS; there may be tests required for the application (gap) and other tiers

Two questions:

• Has anyone looked at hooking OpenSCAP up to CM?
• What is the thinking on handling multiple tiers (platform, application, etc.)?

[mzia]

Hi @openprivacy :

1. We've thought about it but haven't looked into SCAP integration mainly because OSS tools already exist and maintained for it. But that doesn't rule out the the above idea.
2. Multiple tier support is not out of the question, certainly feasible. Please feel free to help out with maturing CM. Schema is defined in JSON, so it can be done.

[mogul]

@openprivacy : Have you looked at the existing compliance-masonry support for executing BDD tests that verify each control? It would be nice and natural to extend this for running BDD or SCAP rules. However, we have no experience/expertise with OpenSCAP; hopefully a community contributor with experience of OpenSCAP can fill in the gap!

As for as multiple-tier support: If I understand your request correctly, I think that's the already-supported common target use-case! See for example cg-compliance, which is composing existing CM YAML for AWS (IaaS-level) and Cloud Foundry (PaaS-level) from other repositories with YAML for cloud.gov itself (specific org-level management) there in the repository.

[mogul]

(Each set of YAML dependencies can come with its own BDD tests... Presumably you'd do the same for components that have corresponding SCAP rules.)