Drupal and FISMA Compliance BoF at Drupalcon LA

it's in the link he posted, but just in case, here it is again https://events.drupal.org/losangeles2015/bofs/drupal-and-fisma-compliance
and it's in 410 on Thursday.

There are a lot of efforts getting Drupal sites compliant, and there are benefits in working together to get help each other make this process more efficient.

• Federal Information Security Management Act (FISMA) – a federal act that outlines compliance, and has a group of families that outline controls driven by risk analysis and finding ways to mitigate the risk.
• National Institute of Standards and Technology (NIST) a Cybersecurity Framework. FISMA is a NIST Standard that is Open Source.

Greg Elin has been working on a project called GovReady - see http://www.govready.org/. This makes it easier to get started with OpenSCAP, an open source NIST certified continuous compliance scanning tool: http://www.open-scap.org/page/Main_Page.

Audience poll: 50% in attendance working on side of securing Drupal, remainder mainly working on the hosting/infrastructure layer, and a few focusing mainly on documentation efforts.

Looking at the Drupal Layer of FISMA:

• Discussion on how are people certifying / assessing the Drupal application layer
• Outline best practices to start automatic checking for standards. Starting with OpenSCAP that calls against the Security Review module.
• There are a number of other Drupal module and other software (like OSSIM) that are Open Source and check for security.
• Tenable NESSUS is now a closed source/licensed, but OpenVAS could be considered an Open Source alternative. But NESSUS is not that expensive, but there are often a number of updates to make it work with checking what is needed.
• http://www.cisecurity.org/ was also mentioned as a source for checks/hardened-config for Apache/MySQL.
• OpenSCAP developers are interested in getting it working on Ubuntu.
• Is there a place / format where we can share the language we use and discover?
  • Groups.drupal.org - security group (and cross post to the compliance group).
  • Perhaps pick one of the security focused distributions to use as a module/configuration reference, add compliance checks/tests and include templated documentation for controls with each check.
• Clarifying the boundaries of where Drupal security level exists
• You can build a suite to test and give you repeatability. Writing content for scanning.
• Your automated tests need to be well written and  be checked for coverage
• Documenting these processes is going to be crucial for helping others get compliant .
• Companies becoming compliant will likely see a change in company policies and processes (things like idle time-outs, increased time training on security).

FISMA Compliance Shortcuts

• There are not many ways to shortcut this process.
• Application layer can be secured (drupal modules to automate)
  • But you can break it with poor site building/code even after the initial security work
  • Environment layer can be secured (secure hosting suppliers)
  • Documentation layer can’t be shortcut as easily

Reference Links

• http://www.govready.org/ and http://www.open-scap.org/page/Main_Page
• FISMA, FedRAMP, and Drupal session slides from prior Drupalcon session - http://www.slideshare.net/mike.lemire/fisma-fedramp-drupal - some examples of SSP controls on slide 18 and FISMA Moderate controls starting at slide 19
• Building a Compliance-Ready Infrastructure - http://denver2012.drupal.org/sites/default/files/BUILDING_AND_SECURING_GOVERNMENT_DRUPAL_SITES_v6.ppt

Drupal Modules

• Paranoia
• Security Review
• Security Kit
• Automated Logout
• Username Enumeration Prevention
• Session Limit
• Honeypot/CAPTCHA/reCAPTCHA
• Password Policy
• Secure Permissions
• Permission Watchdog

Distributions

• Guardr
• Hardened Drupal
• Openpublic (v2) mentions having been reviewed for FISMA

Where can we continue this discussion? Security Group or Compliance Group on Drupal.org. Security Group seems the best fit - cross-post to Compliance group as relevant (note we originally decided on Compliance group, but afterwards realized it was still pending moderation and seemed to have very few members).**

Has anyone started writing SCAP content for testing current compliance of Drupal, Apache/Nginx, MySQL? E.g., tests that private files are secure, that password policies are set, etc. Much of this is done in the Security Review (and other modules listed above), but automated access to the reports is needed. (RESTful API access would be awesome!)

I think the govready.org URL is broke. Should it be http://govready.com/ ? Same thing?