Introduction to the SIMP Compliance Engine (SCE)¶
This guide is written to supplement the SIMP CE and EE documentation. It includes supplemental information for getting started with and using the SIMP Compliance Engine.
What Is the SIMP Compliance Engine (SCE)?¶
SIMP Compliance Engine (SCE) uses existing compliance and security standards to generate configuration that is directly applicable to SIMP-managed systems. Utilizing Puppet, SCE becomes a data source that inspects applied module parameters and compares them to the values required by policy. SIMP then can optionally force Puppet to set those parameters. When used to its fullest potential, SCE can create a compliant Puppet environment where it is not possible to implement a change to a system that would fail compliance audits.
SCE is implemented by the compliance_engine Ruby gem, which provides a Hiera backend and a command-line tool. It replaces the legacy simp/compliance_markup Puppet module.
How Organizations Use SCE¶
- Enforce compliance standards
- Enforce enterprise security rules
- Enforce business rules
Puppet Integration¶
SCE's compliance data is stored in Puppet modules. SCE looks for data in the SIMP/compliance_profiles/ (or simp/compliance_profiles/) path, relative to each module, and loads all yaml and json files that are present. Data found in the SCE data format will be merged together and used as the data source for enforcement.
Configuring Puppet to Use SCE¶
In order to use SIMP Compliance Engine, you need to add it to your Puppet environment hierarchy in hiera.yaml.
When adding SCE to an existing Puppet environment, we recommend adding it as the last entry in the hierarchy.
Make sure the compliance_engine gem is installed on your Puppet Server; it is included in the SIMP Enterprise installation.
To enable SIMP Compliance Engine in your Puppet environment, add the name and lookup_key in the following example to be the last entry in /etc/puppetlabs/code/environments/production/hiera.yaml.
If you are migrating from the legacy compliance_markup module and still have data using the old compliance_markup::* Hiera keys, enable the compatibility option so both sets of keys are honored during the transition:
- name: "SIMP Compliance Engine"
lookup_key: "compliance_engine::enforcement"
options:
compliance_markup_compatibility: true
See the Reference for the full key mapping.
Reporting¶
The legacy compliance_markup module generated catalog-compliance reports on the Puppet Server. The compliance_engine gem is a Hiera backend only and does not generate reports; compliance scanning and reporting are provided by the Sicura Agent and Console.
Enforcement with SCE¶
Adding profile names from the SCE compliance data to compliance_engine::enforcement will enable enforcement of all settings referenced by those profiles.
Applying a Compliance Profile¶
To apply a compliance profile to a node, add the following settings to the node's Hiera data specifying the compliance profile to apply:
---
# Linux nodes
classes:
- 'simp'
- 'simp_options'
# Setup compliance engine enforcement
compliance_engine::enforcement:
- 'cis:level:1:server'
# Windows nodes
classes:
- 'simp_windows'
# Setup compliance engine enforcement
compliance_engine::enforcement:
- 'cis:level:1:member:server'
You can also specify a list of compliance profiles to apply, in order from highest priority to lowest. Each profile will be compiled separately and values in the highest priority profile will be enforced by SCE. This can allow you to create a small custom profile based on a built-in profile with changes only to settings you wish to customize.
For example, to apply CIS Level 1 Member Server and DISA STIG MAC-1 Classified compliance settings, and to force the CIS settings to always override DISA settings, add the following to Hiera: