Using OpenSCAP with security profiles for OSPP and PCI DSS
There are several security profiles used for compliance in the industry. Two of the most common, which we will review here, are the Operating System Protection Profile (OSPP) and the PCI DSS.
The OSPP standard is heavily used in the public sector, serving general-purpose systems and also as the baseline for other more restrictive environments (that is, defense accredited systems).
PCI DSS is one of the most widely used standards in the finance sector, which also applies to other sectors that want to provide online payments using credit cards.
RHEL 8 provides references to verify those profiles using OpenSCAP tools. Let's move to the /usr/share/xml/scap/ssg/content/
directory, where they reside, and take a look:
[root@rhel8 ~]# cd /usr/share/xml/scap/ssg/content/ [root@rhel8 content]# ls *rhel8* ssg-rhel8-cpe-dictionary.xml ssg-rhel8-ds-1.2.xml ssg-rhel8-ocil.xml ssg-rhel8-xccdf...