Drupal and FISMA Compliance BoF at Drupalcon LA

https://events.drupal.org/losangeles2015/bofs/drupal-and-fisma-compliance

What room?

it's in the link he posted, but just in case, here it is again https://events.drupal.org/losangeles2015/bofs/drupal-and-fisma-compliance
and it's in 410 on Thursday.

Just a minor kind of drupal geeky girl and for the US government no less!

This is very exciting stuff. Only recently did I learn about security scanning (and I still have a lot to learn) but I'm already a convert: open source security scanning tools and the content that drives them promise to greatly increase the ease and effectiveness of security devops on every scale.

OpenSCAP 1.2.3 has been compiled for a RHEL7 testbed and I plan to share RPMs soon. (We want to offer the same tool set for AWS and Ubuntu soon.) The next step is enhancing/expanding the STIG/SCAP content to include apps like Drupal, Apache/Nginx and Mysql.

Plug: I'll be talking about some of this work on the other coast at DevOpsDays DC next month.

(Not sure why the links aren't working. Here they are bare: https://github.com/OpenSCAP and https://devopsdaysdc2015.busyconf.com/proposals/552f23ec42517cc87a000007)

There are a lot of efforts getting Drupal sites compliant, and there are benefits in working together to get help each other make this process more efficient.

• Federal Information Security Management Act (FISMA) – a federal act that outlines compliance, and has a group of families that outline controls driven by risk analysis and finding ways to mitigate the risk.
• National Institute of Standards and Technology (NIST) a Cybersecurity Framework. FISMA is a NIST Standard that is Open Source.

Greg Elin has been working on a project called GovReady - see http://www.govready.org/. This makes it easier to get started with OpenSCAP, an open source NIST certified continuous compliance scanning tool: http://www.open-scap.org/page/Main_Page.

Audience poll: 50% in attendance working on side of securing Drupal, remainder mainly working on the hosting/infrastructure layer, and a few focusing mainly on documentation efforts.

Looking at the Drupal Layer of FISMA:

• Discussion on how are people certifying / assessing the Drupal application layer
• Outline best practices to start automatic checking for standards. Starting with OpenSCAP that calls against the Security Review module.
• There are a number of other Drupal module and other software (like OSSIM) that are Open Source and check for security.
• Tenable NESSUS is now a closed source/licensed, but OpenVAS could be considered an Open Source alternative. But NESSUS is not that expensive, but there are often a number of updates to make it work with checking what is needed.
• http://www.cisecurity.org/ was also mentioned as a source for checks/hardened-config for Apache/MySQL.
• OpenSCAP developers are interested in getting it working on Ubuntu.
• Is there a place / format where we can share the language we use and discover?
  • Groups.drupal.org - security group (and cross post to the compliance group).
  • Perhaps pick one of the security focused distributions to use as a module/configuration reference, add compliance checks/tests and include templated documentation for controls with each check.
• Clarifying the boundaries of where Drupal security level exists
• You can build a suite to test and give you repeatability. Writing content for scanning.
• Your automated tests need to be well written and be checked for coverage
• Documenting these processes is going to be crucial for helping others get compliant .
• Companies becoming compliant will likely see a change in company policies and processes (things like idle time-outs, increased time training on security).

FISMA Compliance Shortcuts

• There are not many ways to shortcut this process.
• Application layer can be secured (drupal modules to automate)
  • But you can break it with poor site building/code even after the initial security work
  • Environment layer can be secured (secure hosting suppliers)
  • Documentation layer can’t be shortcut as easily

Reference Links

• http://www.govready.org/ and http://www.open-scap.org/page/Main_Page
• FISMA, FedRAMP, and Drupal session slides from prior Drupalcon session - http://www.slideshare.net/mike.lemire/fisma-fedramp-drupal - some examples of SSP controls on slide 18 and FISMA Moderate controls starting at slide 19
• Building a Compliance-Ready Infrastructure - http://denver2012.drupal.org/sites/default/files/BUILDING_AND_SECURING_GOVERNMENT_DRUPAL_SITES_v6.ppt

Drupal Modules

• Paranoia
• Security Review
• Security Kit
• Automated Logout
• Username Enumeration Prevention
• Session Limit
• Honeypot/CAPTCHA/reCAPTCHA
• Password Policy
• Secure Permissions
• Permission Watchdog

Distributions

• Guardr
• Hardened Drupal
• Openpublic (v2) mentions having been reviewed for FISMA

Where can we continue this discussion? Security Group or Compliance Group on Drupal.org. Security Group seems the best fit - cross-post to Compliance group as relevant (note we originally decided on Compliance group, but afterwards realized it was still pending moderation and seemed to have very few members).**

Thanks to @akaroleff for the fantastic notes and for everyone for contributing to a great discussion!

Please note that after some further discussions, we realized that the Security group was probably a better bet than the Compliance group for further discussion, at least for the time being (feel free to cross-post as appropriate, of course).

Has anyone started writing SCAP content for testing current compliance of Drupal, Apache/Nginx, MySQL? E.g., tests that private files are secure, that password policies are set, etc. Much of this is done in the Security Review (and other modules listed above), but automated access to the reports is needed. (RESTful API access would be awesome!)

Note that Security Review has Drush integration, and many of the others could be checked with Drush pm-list and vget.

I believe security_review

I have remote scanning working now. Next steps are remote (ansible-based) hardening, simplifying the front end, installing a test Drupal site and experimenting with drush commands for security/compliance. I'll post when I have something useful to share (hopefully next week).

I think the govready.org URL is broke. Should it be http://govready.com/ ? Same thing?

-Andre

• greggles
• mlhess
• coltrane

• Arabic
• Alappuzha
• Event Platform
• Western Ohio User Group
• Goa Drupal Community
• Liverpool
• Chandigarh Drupal Geeks (C.D.G.)
• API-First Working Group
• Compony opinionated developers
• 4SPOTS