论文标题
用scapolite进行硬化：一种基于DevOps的方法，用于改善大型组织的安全配置指南的创作和测试
Hardening with Scapolite: a DevOps-based Approach for Improved Authoring and Testing of Security-Configuration Guides in Large-Scale Organizations
论文作者
论文摘要
安全硬化是配置IT系统的过程，以确保系统的组件和数据处理或存储的数据的安全性。在许多情况下，所谓的安全配置指南被用作安全硬化的基础。这些指南描述了针对操作系统和标准应用程序等组件的安全配置设置。必须严格测试安全配置指南和自动化机制以实施和验证，因为错误的实现或硬化指南的检查可能会严重影响系统的安全性和功能。在西门子，中央维护的安全配置指南随附机器可读信息，指定每个必需的配置步骤的实现和验证。指南保存在GIT存储库中；自动化管道生成用于实现和检查的工件，例如Windows的PowerShell脚本，并在AWS图像上对这些工件进行测试。本文介绍了我们以DevOps启发的方法的经验来创作，维护和测试安全配置指南。我们希望分享这些经验，以帮助其他组织的安全性硬化，从而提高其系统的安全性。
Security Hardening is the process of configuring IT systems to ensure the security of the systems' components and data they process or store. In many cases, so-called security-configuration guides are used as a basis for security hardening. These guides describe secure configuration settings for components such as operating systems and standard applications. Rigorous testing of security-configuration guides and automated mechanisms for their implementation and validation are necessary since erroneous implementations or checks of hardening guides may severely impact systems' security and functionality. At Siemens, centrally maintained security-configuration guides carry machine-readable information specifying both the implementation and validation of each required configuration step. The guides are maintained within git repositories; automated pipelines generate the artifacts for implementation and checking, e.g., PowerShell scripts for Windows, and carry out testing of these artifacts on AWS images. This paper describes our experiences with our DevOps-inspired approach for authoring, maintaining, and testing security-configuration guides. We want to share these experiences to help other organizations with their security hardening and, thus, increase their systems' security.
