Using OpenSCAP to help achieve HIPAA compliance with Red Hat Enterprise Linux 8.3

Tracking and controlling activities across a large environment is challenging in any IT environment. Adding requirements like HIPAA compliance makes life even more challenging for IT teams, and takes time away from addressing higher-level business problems. In this post, we'll look at how teams can use OpenSCAP in Red Hat Enterprise Linux (RHEL) to help with Health Insurance Portability and Accountability Act (HIPAA) compliance and focus on work that delivers real value for the business.

Meet OpenSCAP in RHEL 8.3

Delivering a more secure platform has been front-and-center for RHEL since its first releases. When it comes to security, timely inspection to identify vulnerabilities is critical for Red Hat customers. They are frequently looking for tools to evaluate and improve the security of their environments quickly. 

OpenSCAP, included in your RHEL subscription, can perform compliance and vulnerability scanning on RHEL systems and help teams identify and remediate problems as they crop up. OpenSCAP is a SCAP compliant scanner. SCAP scanners are driven by several different industry policies, profiles, and rules. The SCAP Security guide has content that is Red Hat’s interpretation of the policies, rules, and related Ansible playbooks for remediation to facilitate automation of configuration and auditing.  In RHEL 8.3, we added support for the Center for Internet Security (CIS) and the HIPAA benchmarks.

Although there is a bit of overlap between the security controls that cover HIPAA and those that cover CIS, when you pull back the curtain, these compliance regulations are different in the way they are implemented. HIPAA is a subjective standard that is very focused on policies, training, and processes. This means that HIPAA does not precisely define the technical specifications or methods needed to achieve compliance. Instead, a consensus-driven approach is used to map security checks to various HIPAA requirements. Some of the key elements of HIPAA include enabling the audit service, disabling root login using SSH, and enabling FIPS mode. 

On the other hand, CIS provides prescriptive guidance to establish a security baseline configuration, including detailed recommendations for auditing, logging, monitoring, identity management, and access control.  This post’s focus will be on HIPAA compliance in RHEL 8.3, and if you’d like to learn more about CIS, check the following post about OpenSCAP and CIS.

The OpenSCAP ecosystem is rich, offering multiple tools to assist administrators and auditors in assessing, measuring, and enforcing security baselines. Several hardening guides and configuration baselines are developed by the open-source community, allowing you to choose a security policy that best suits your organization’s needs, regardless of its size. 

In RHEL 8.3, here are the key steps to scan against the HIPAA profile:

# yum install openscap-scanner scap-security-guide

# oscap xccdf eval --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_hipaa --results /tmp/scan.xml /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

# oscap xccdf generate report /tmp/scan.xml > /tmp/report.html

Setting this up is pretty simple — before you begin the installation,  you select “Security Policy” in the installation wizard and then pick the “HIPAA” profile.

Automating your scans to help remain compliant

We understand that scanning for a compliance standard is not just a one-off task. You need to scan your systems regularly to ensure that you are maintaining compliance with the standard. Any deviation from the policy will need to be remediated.

With OpenSCAP and Red Hat automation platform, you can take control of your organization’s exposure by automating security scans and compliance at scale in hybrid environments. This means that you can use OpenSCAP using several products in Red Hat’s Management portfolio, including Red Hat Ansible Automation Platform, Red Hat Smart Management with Satellite, and Red Hat Insights to scan across your deployment portfolio. 

Want to try OpenSCAP in Red Hat Enterprise Linux? Check out our live demo here.