Implementing content for Automated Security Compliance
to custom policies

Who is this workshop best for?

This workshop is geared toward system administrators, cloud administrators and operators, architects, and others working on infrastructure operations management who are interested in learning how to automate security compliance using Red Hat® provided tooling for compliance against both industry standard and custom policies.

This is a no cost workshop for both government and contractors.

Overview and Prerequisites

This workshop introduces you to the ComplianceAsCode project, a comprehensive tool that creates content for automated security tools. The project contains over 1,000 rules—​elements of security policies. Rules have descriptions, justifications, and references to existing security standards. They also have Open Vulnerability and Assessment Language (OVAL) checks, bash remediations, and Red Hat Ansible® Automation content to a varying degree.

ComplianceAsCode enables automated evaluation and fast and efficient remediations against security controls for compliance with regulatory or custom profiles, and for automated configuration compliance. It allows you to produce a tailor-made security policy for your company with minimal effort, and the OpenSCAP ecosystem can do the scanning and support for problem resolution. Specifically, OpenSCAP is a National Institute of Standards and Technology (NIST) certified scanner designed to perform configuration and vulnerability scans on a system, validate security compliance content, generate reports and guides based on these scans and evaluations, and allows users to automatically remediate systems that have been found in a non-compliant state.

Red Hat Enterprise Linux® provides tools that allow for fully automated compliance audits. These tools are based on ComplianceAsCode and the Security Content Automation Protocol (SCAP) standard and are designed for automated tailoring of compliance policies.

The prerequisites for this lab include basic Linux skills gained from a Red Hat Certified System Administrator (RHCSA®) certification or equivalent system administration skills.

What Attendees Will Learn In This Lab:

• How to use the OpenSCAP scanner to scan systems and perform security fixes as needed.
• How to navigate among existing rules and learn how to modify them and take advantage of parameterization.
• How to create new security profiles and populate them with existing rules.
• How to create new rules from scratch and add them to security profiles.
• How to write OVAL checks with minimal effort and ensure correctness.
• How to create Ansible Automation content for remediations of systems.