Auditing Security Policy with OpenSCAP

Throughout the two chapters that preceded this one, we established the value of applying a security policy such as the CIS Benchmark to your Enterprise Linux infrastructure. We have discussed a variety of methods for both applying it and ensuring it remains enforced; the latter point is especially important in an infrastructure where a wide array of people have superuser access to your Linux servers. Although we have established ways that both shell scripting and Ansible can assist with auditing the compliance of your infrastructure with your chosen security policy, we have also established that neither of these are particularly suited to providing readable and actionable reports of a large infrastructure. For example, it is entirely reasonable that an infrastructure security team might want a readable report showing the compliance of the...