- SCAP-On-Apple - lists.macosforge.org

Re: [SCAP-On-Apple] [Fed-Talk] SCAP-On-Apple: I cannot find any automated SCAP content on the site.
by Luis Nunez 29 Jan '13

29 Jan '13

Not sure if someone mention this on the tread but DISA just released a STIG for iOS 6 (XCCDF). It contains some 60 rules. I've not done a in-depth comparison but it looks very similar to the the jOVAL SCAP content for iOS5. With some additional updates I could see the iOS6 STIG having all the automation capabilities (OVAL). http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html -ln On Jan 29, 2013, at 10:32 AM, John Oliver wrote: > LANL (Los Alamos National Laboratory) is a big-time Mac user. > > From: David Solin <david(a)joval.org> > Organization: jOVAL > Date: Tuesday, January 29, 2013 7:21 AM > To: Apple Fed-Talk <fed-talk(a)lists.apple.com> > Subject: Re: [Fed-Talk] SCAP-On-Apple: I cannot find any automated SCAP content on the site. > > The reason that NIST puts out USGCB content for Windows and Linux is that it's a funded project. I don't personally believe that it's realistic to expect that anyone is ever going to go through the trouble to develop, test and maintain SCAP content unless that's how they're planning to feed their family -- meaning someone has to pay for it. > > There are commercial vendors like SecPod who create Mac content for the purpose of selling it. I have no idea how much Mac content they sell, but we support their efforts as part of our own (that is, jOVAL's) business development program. If there are US government agencies (like NASA? DoD? NSA? NOAA?) that depend on Macs, then it might make sense for at least one of them to fund a position whose purpose is to create automated security content around existing best-practices like the manual STIGs. Heck, it could even be a project for an intern! Since the government's not in the business of selling this sort of thing, they might even decide to make it available to the public. > > On the other hand, there are also vendors who release vulnerability signatures for their own products, in the form of SCAP content. Novell (SUSE) and Cisco come to mind as examples. Shawn continues to strongly hint (if not outright declare) that's just not going to happen, but I think a lot of people are hoping that Apple might decide to go down this route. If they did, it would no doubt be a great starting-point for someone to put together an XCCDF benchmark. > > We would be happy to work with anyone who wants to create SCAP content for OSX or iOS, to insure that there is a working open-source interpreter capable of running it. Anyone fitting this description can send me an email to get started. > > Regards, > --David Solin > > On 1/29/2013 8:50 AM, Link, Peter R. wrote: >> Raymond, >> The whole idea of the SCAP-on-Apple project is to provide free SCAP content for OSX systems. This means providing OVAL content as well as XCCDF and CVE. I believe Apple already provides the CPE product dictionary. Some vendors have provided varying levels of XCCDF content while others have begin providing the mechanism to deliver this content to Macs and iOS devices. I've seen suggestions on the OVAL mail threads suggestions people work with Apple on this. As Shawn continues to remind us (especially me), Apple doesn't have the resources allocated to do all of this, especially with the frequency of changes software goes through and the instance amount of time it takes to get anything through a committee or standards organization. >> >> I've also discussed the chicken and the egg aspects of SCAP and security manuals. In my mind security manuals come first followed by generation of SCAP content so that something like the federally mandated USGCB baseline configuration can be released. People will argue FDCC/USGCB never works but until you try it and determine what doesn't work, it's all talk and no action. People will argue they can configure systems better than others but will not spend the time determining if one of their settings actually puts a system at risk. Others will simple take the direction of auditors who have no familiarity with OSX and shut everything down without questioning whether there's even a security vulnerability reason to do it. >> >> For those of you who actually have a large enough Mac installation to justify more than a couple Mac technicians, I'd suggest getting them involved in this process by working with others on OVAL development, http://oval.mitre.org (check for mailing lists), as the first step in creating standardized system checks. Once on this list, remind the unix people that although OSX is a unix OS, it has its own way of operating, which isn't the same as linux and solaris and, therefore, needs to be thought of as a totally separate OS instead of simply trying to adapt unix tests to work with OSX. We've been there with every Windows vendor trying to force altered Windows applications onto Macs. Now unix application vendors are trying to do the same thing. >> >> This is my final explanation and push for getting people involved in this project. I'm not a programmer, I'm a facilitator; someone who tries to get others to get together and work on a project for the common good. That common good is the automated configuration validation for continuous monitoring as required by every federal system that follows NIST special publications. Remember, CM-6, Configuration Settings, states that you have to have a documented list of settings for your system. A few other security controls tell you what some of those settings have to be but the vast majority of them have to come from somewhere/someone who has figured out what must be done to properly secure a system. My goal for a long time has been to get a USGCB baseline configuration for OSX but until we can find programmers and IT personnel who are willing to work together to put together the parts necessary for this baseline, we won't have one. >> >> I'm done and it's before my first cup of tea (6:49am). >> >> On Jan 28, 2013, at 12:12 PM, "Jacob, Raymond A Jr. CIV SPAWARSYSCEN-ATLANTIC, 58830" <raymond.jacob(a)navy.mil> wrote: >> >>> Shawn: >>> /* SCAP Content means Mac OS/X ... */ >>> I did not see any recent messages in the SCAP-On-Apple email lists. >>> DoD(DISA STIG) as far as I know only has manual SCAP content >>> and as far as I can recall USCG referred one to the DISA STIG. >>> >>> Shawn: >>> 1. I apologize in advance for not reading carefully enough or >>> not understanding what I have read. >>> >>> 2. Can you ask your POC's at government agencies, if they can make their automated SCAP content >>> available to the rest of the Government Community? >>> >>> 3. Can you mention 3rd parties that have automated SCAP content for Mac OS/X? >>> >>> Thank you, >>> raymond >>> _______________________________________________ >>> Do not post admin requests to the list. They will be ignored. >>> Fed-talk mailing list (Fed-talk(a)lists.apple.com) >>> Help/Unsubscribe/Update your Subscription: >>> https://lists.apple.com/mailman/options/fed-talk/link1%40llnl.gov >>> >>> This email sent to link1(a)llnl.gov >> >> Peter Link >> Cyber Security Analyst >> Cyber Security Program >> Lawrence Livermore National Laboratory >> PO Box 808, L-315 >> Livermore, CA 94551-0808 >> link1(a)llnl.gov >> >> >> >> >> >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Fed-talk mailing list (Fed-talk(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> https://lists.apple.com/mailman/options/fed-talk/david%40joval.org >> >> This email sent to david(a)joval.org > > > -- > jOVAL.org: SCAP Simplified. > Learn More | Features | Download > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Fed-talk mailing list (Fed-talk(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/fed-talk/john.n.oliver.ctr%40navy.m… This email sent to john.n.oliver.ctr(a)navy.mil > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Fed-talk mailing list (Fed-talk(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/fed-talk/lnunez%40c3isecurity.com > > This email sent to lnunez(a)c3isecurity.com

1 0

Re: [SCAP-On-Apple] [OVAL-DEVELOPER-LIST] OVAL 5.11 Release Goals and Timeline
by Haynes, Dan 07 Nov '12

07 Nov '12

Hi Peter, Great question! As a little background for those who may not have seen the announcement go by, Shawn Geddis of Apple recently launched the SCAP-On-Apple project on MacOSForge (http://scap-on-apple.macosforge.org/) which is a community driven project with the following mission. “The SCAP-On-Apple Open Source Project engages and empowers the SCAP community to strengthen the awareness, knowledge and collaboration on SCAP Content, Tools and Solutions with authoritative data for the Apple Platforms (OSX and iOS).” The SCAP-On-Apple project is meant to be a collaborative place for those interested in having SCAP support for Apple products and is meant to complement existing efforts. As you mentioned, I don’t think there are any explicit ground rules so I will give my thoughts on how I see the project fitting in from an OVAL perspective. From an OVAL perspective, the major benefit will be the authoritative information and reach back into Apple that Shawn Geddis will provide as well as the domain expertise and experience from members of the community who are focused on supporting Apple products. This is very helpful because we (the OVAL team at MITRE) are not domain experts in all platforms (and cannot be from a resources perspective) and we will be actively looking to the SCAP-On-Apple community help drive support for Apple products in OVAL. With regards to content development, I think a lot of the discussion (e.g. what settings to check in a security guide, how to check for vulnerabilities, etc.), development, and review would occur on the SCAP-On-Apple mailing lists. When complete, the SCAP-On-Apple project could then host that content on the project site and make it available to the community. Or, the project could decide that they want to have an existing repository to host the content. Both are valid approaches, however, this is a decision that the SCAP-On-Apple project will have to make. Although from the Contribute page on the wiki (http://scap-on-apple.macosforge.org/trac/wiki/contribute/) it sounds like the project will be maintaining a repository of content specific to Apple products. As far as the OVAL Language is concerned, I could see the SCAP-On-Apple project as being the incubator for discussing and developing new features needed to fully check Apple platforms with OVAL. The SCAP-On-Apple project should feel free to use the OVAL Language Sandbox (http://oval.mitre.org/language/sandbox.html) if they would like to implement schema changes. Once developed, the SCAP-On-Apple project could submit these features to the broader OVAL community (oval-developer-list) for review, discussion, and integration into an official release of OVAL. I also see it as the go to place when there are questions related to Apple platforms. Lastly, for tools, it will be a good place to ask questions about how to best implement features as it pertains to Apple products and provide a central location to share code and utilities with other members of the community who are interested in supporting Apple products. Anyways, those are my thoughts on how it would fit in. It would be great to hear what others think. Thanks, Danny From: Link, Peter R. [mailto:link1@llnl.gov] Sent: Tuesday, November 06, 2012 9:16 AM To: Haynes, Dan Subject: Re: [OVAL-DEVELOPER-LIST] OVAL 5.11 Release Goals and Timeline Danny, How are you going to integrate OVAL work on OSX/iOS with Apple's SCAP-on-Apple project? I haven't seen any information on what the ground rules are. Thanks. On Nov 5, 2012, at 12:50 PM, "Haynes, Dan" <dhaynes(a)MITRE.ORG<mailto:dhaynes@MITRE.ORG>> wrote: During the 2012 4th Quarter OVAL Board Meeting and the weeks following, we worked with the OVAL Board to develop goals and a timeline for the OVAL 5.11 release. Meeting minutes can be found here (http://oval.mitre.org/community/archives/boardminutes/20121015.pdf) The goals were developed based on what we have been hearing from the community. 3. Improve Apple support such that the Apple Security Guides and DISA STIGs are fully automatable for OSX and iOS 4. Peter Link Cyber Security Analyst Cyber Security Program Lawrence Livermore National Laboratory PO Box 808, L-315 Livermore, CA 94551-0808 link1(a)llnl.gov<mailto:link1@llnl.gov>

1 0

Where/When do we start?
by Link, Peter R. 01 Nov '12

01 Nov '12

In light of recent postings asking about iOS6, bluetooth, and SCAP content I am reposting my email from early October (below). It was my understanding this project would replace or be in addition to efforts managed by NIST as the main project site for the creation of all aspects of SCAP content for Apple products. I am hoping it won't simply turn into another fed-talk email list. When are we going to start working on OVAL and XCCDF content? Will we simply take what DISA and CIS have done, fixing/enhancing their code and adding the additional parts necessary for full SCAP compliance? How will this be done? The SCAP-on-Apple website has a ticketing system but who is going to start? What are the ground rules? CIS has an OSX 10.8 project started and DISA has draft iOS6 content. I now CIS is more or less a private company while DISA is a federal organization. Both of these entities can complicate matters so I'd like to get the direction of SCAP-on-Apple out in the open. I also know there is work being done by OVAL but how will we make use of their contributions? Or do we contribute to them? As for device configuration, LLNL is really pressing for expanded use of the new Profiles capability so we'd like to see configuration settings pushed in that direction instead of creating a lot of scripts. Profiles will be a whole lot easier to manage and test than scripts. ----- (repost from October 9) Now that the SCAP on Apple working group has been created, I would like to know if any initial guidelines were discussed at the BoF meeting. Who's going to start? With what configuration information? Will this site be the primary working area for SCAP content for Apple (OSX and iOS)? Will people still use OVAL's repository for Apple products as the primary source or duplicate content between the two? I know some work has been done by various people. Will any of that be submitted to this site or is everything starting from the ground up? **** Not that anyone has asked but my ultimate goal for this project is to provide complete SCAP content for tools (including OCIL) necessary to create, validate, and remediate a USGCB baseline configuration for OSX and secondarily, for iOS. This is a multistep process but having a USGCB configuration has been on my list for many years. Peter Link Cyber Security Analyst Cyber Security Program Lawrence Livermore National Laboratory PO Box 808, L-315 Livermore, CA 94551-0808 link1(a)llnl.gov<mailto:link1@llnl.gov> The contents of this message are mine personally and do not reflect the views or position of the U.S. Department of Energy, Federal Government, National Nuclear Security Administration, Lawrence Livermore National Security, or Lawrence Livermore National Laboratory.

1 0

where may I find SCAP content for OS/X 10.8 Mountain Lion? is is on the DISA site?
by Jacob, Raymond A Jr. CIV SPAWARSYSCEN-ATLANTIC, 58830 31 Oct '12

31 Oct '12

Thank you R"aymond

2 1

Re: [SCAP-On-Apple] [Fed-Talk] iOS 6 STIG
by Luis Nunez 31 Oct '12

31 Oct '12

recently the http://scap-on-apple.macosforge.org/ site came online. I've not seen activity since the meeting in early this month. For reference here is the NSA SCAP content: http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/ope… -ln On Oct 30, 2012, at 5:36 PM, David Solin wrote: > Is there no plan for automated content, like the NSA produced? > > On 10/30/2012 10:46 AM, Luis Nunez wrote: >> DISA draft Apple iOS 6 Security Technical Implementation Guide for comment. >> >> http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html#iOS6 >> >> >> -ln >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Fed-talk mailing list (Fed-talk(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> https://lists.apple.com/mailman/options/fed-talk/david%40joval.org >> >> This email sent to david(a)joval.org > > > -- > jOVAL.org: SCAP Simplified. > Learn More | Features | Download > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Fed-talk mailing list (Fed-talk(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/fed-talk/lnunez%40c3isecurity.com > > This email sent to lnunez(a)c3isecurity.com

1 0

Re: [SCAP-On-Apple] [Fed-Talk] iOS 6 STIG
by Luis Nunez 31 Oct '12

31 Oct '12

I agree. They look contradictory. below are the sections that looks contradictory. Taken from the "U_Apple_iOS_6_V1R0_1_Overview.pdf". 2.13 Tethered Modem Use An iPhone and iPad can be used as an “IP” modem or a “tethered modem” to provide a wireless Internet connection for a laptop computer or other device, such a Wi-Fi only iPad. In most cases, this is less expensive than buying a broadband wireless card and setting up a separate broadband wireless account. This use is permitted in DoD. Note that most wireless carriers disable the capability for using an iOS device to directly set up a tethered connection to a laptop via an Internet connection, requiring subscribers to pay an additional fee to acquire “tethered” service. Procedures for setting up IP modem service on a laptop are available from each wireless carrier. 2.14 Personal Hotspot An iOS 6 device can be set up as a personal cellular hotspot where laptops, smartphones, or tablet devices can connect to the device via a Wi-Fi, Bluetooth, or USB connection and access the Internet via the iPhone or iPad cellular connection. This configuration is not authorized in DoD because the native iOS encryption supporting Wi-Fi is not FIPS-validated. btw I am ccing the scap-on-apple list for automation perspective. -ln On Oct 31, 2012, at 9:00 AM, STEMPNAKOWSKI, DAVID A MSgt USAF AETC AETC/A6OI wrote: > Before I make a comment on the comment matrix and possibly make myself look > stupid, does section 2.13 and 2.14 seem to contradict themselves? I > understand the difference between "tethered" and "hotspot" but I'm not aware > of how to use an iPhone or iPad connected via a USB cable as a tethered > modem. I'm more familiar with that config over WiFi or Bluetooth. > > > David A. Stempnakowski, MSgt, USAF > AETC/A6OI > NCOIC, Network Infrastructure > AETC Software Benefits Administrator > DSN 487-7513 Comm 652-7513 > > > -----Original Message----- > From: fed-talk-bounces+david.stempnakowski=us.af.mil(a)lists.apple.com > [mailto:fed-talk-bounces+david.stempnakowski=us.af.mil@lists.apple.com] On > Behalf Of Luis Nunez > Sent: Tuesday, October 30, 2012 10:46 AM > To: fed-talk(a)lists.apple.com > Subject: [Fed-Talk] iOS 6 STIG > > DISA draft Apple iOS 6 Security Technical Implementation Guide for comment. > > http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html#iOS6 > > > -ln > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Fed-talk mailing list (Fed-talk(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/fed-talk/david.stempnakowski%40us.af > .mil > > This email sent to david.stempnakowski(a)us.af.mil

1 0

Draft iOS 6 STIG
by Luis Nunez 29 Oct '12

29 Oct '12

fyi, DISA released a Draft Apple iOS 6 STIG. The technical interchange meeting(call) will take place on 15 November. Submit comments before the call. http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html#iOS6 -ln

1 0

Where/When do we start?
by Link, Peter R. 09 Oct '12

09 Oct '12

Now that the SCAP on Apple working group has been created, I would like to know if any initial guidelines were discussed at the BoF meeting. Who's going to start? With what configuration information? Will this site be the primary working area for SCAP content for Apple (OSX and iOS)? Will people still use OVAL's repository for Apple products as the primary source or duplicate content between the two? I know some work has been done by various people. Will any of that be submitted to this site or is everything starting from the ground up? **** Not that anyone has asked but my ultimate goal for this project is to provide complete SCAP content for tools (including OCIL) necessary to create, validate, and remediate a USGCB baseline configuration for OSX and secondarily, for iOS. This is a multistep process but having a USGCB configuration has been on my list for many years. Peter Link Cyber Security Analyst Cyber Security Program Lawrence Livermore National Laboratory PO Box 808, L-315 Livermore, CA 94551-0808 link1(a)llnl.gov<mailto:link1@llnl.gov> The contents of this message are mine personally and do not reflect the views or position of the U.S. Department of Energy, Federal Government, National Nuclear Security Administration, Lawrence Livermore National Security, or Lawrence Livermore National Laboratory.

1 0