Red Hat adopts ROLIE protocol for automated exchange of security compliance assets

This is a primer on the implementation of the ROLIE protocol. The purpose of this report is to recommend automated processes for information exchange of various security compliance and vulnerability management assets using the ROLIE protocol and its open source implementation, Golie.

Problem Space

Attainment and maintenance of security compliance are becoming increasingly automated. Compliance officers and IT professionals are being re-trained, and checklist sheets are being replaced with machine-readable recipes often in the form of Security Content Automation Protocol (SCAP). Red Hat and the open source world at large have embraced this trend and as a result, security compliance policies, scanner tools, and vulnerability feeds are readily available.

The National Institute of Standards and Technology (NIST, the organization behind the SCAP standard) has been working towards the next generation of compliance standards: Security Content Automation Protocol (SCAP) Version 2, Open Security Controls Assessment Language (OSCAL), Software Identification (SWID), and the Resource-Oriented Lightweight Information Exchange (ROLIE). These upcoming standards aim to standardize the audit beyond the endpoint, and in effect, they not only create a path for future tools to interoperate with these standards, but they facilitate automation of assessments and consumption of security content in a standardized, machine-readable way. In this blog post, we will take a closer look at the ROLIE protocol.

Introduction to ROLIE protocol

As previously mentioned, ROLIE stands for the Resource-Oriented Lightweight Information Exchange. The ROLIE specification is governed under RFC 8322 and is actively being developed. ROLIE provides a standardized mechanism that allows security automation content to be discovered, syndicated, and exchanged as part of a paid service or open for everyone to consume. 

The ROLIE specification has extensions that allow ROLIE to support vulnerability feeds in the form of Common Vulnerability Enumeration (CVE) format, threat intelligence feeds in the form of the Structured Threat Information Expression (STIX) format, software descriptors in the form of Software Identification Tag (SWID Tag) and the Concise SWID (COSWID) formats, and checklist feeds in the form of SCAP. 

In other words, ROLIE is a versatile protocol that can be used in a variety of use cases exchanging compliance assets. ROLIE provides a content syndication approach that allows software creators, vulnerability reporters, and configuration setting checklist developers to establish federated repositories of the security content they produce. The key resource for understanding ROLIE’s role in the context of SCAPv2 is NIST.CSWP.09102018. 

Looking at the protocol, the well known Atom Syndication Format and the Atom Publication Protocol is used as the base for the ROLIE design. The key building blocks of the Atom protocol are the <feed/> and <entry/> elements. ROLIE extends those elements with custom elements that hold compliance-related information. 

ROLIE can be formatted as XML or JSON. The following is an illustrative example of a ROLIE checklist feed in JSON with a single entry that advertises to the world the existence of a SCAP 1.3 DataStream for Red Hat Enterprise Linux 8.

{
  "feed": {
    "id": "compliance-as-code",
    "title": "Rolie feed for the latest SCAP files by ComplianceAsCode",
    "updated": "2020-08-24T11:11:16Z",
    "entry": [
      {
        "id": "sds:ssg-rhel8-ds.xml",
        "title": "SCAP DataStream for Guide to the Secure Configuration of Red Hat Enterprise Linux 8",
        "link": [
          {
            "href": "https://atopathways.redhatgov.io/compliance-as-code/scap/ssg-rhel8-ds.xml",
            "length": 16611602
          }
        ],
        "published": "2020-08-24T11:11:19Z",
        "updated": "2020-08-22T10:21:30Z",
        "content": {
          "type": "application/xml",
          "src": "https://atopathways.redhatgov.io/compliance-as-code/scap/ssg-rhel8-ds.xml"
        },
        "format": {
          "schema": "http://scap.nist.gov/schema/scap/source/1.2",
          "version": "1.3"
        }
      }
    ]
  }
}

$ golie new ./existing_SCAP_files/ 

$ golie info ./existing_SCAP_files/feed.json
Document Type: ROLIE Feed
Title: Red Hat Vulnerabilities OVAL
Updated: 2020-08-20T12:37:43Z
Contains 229 entries.
    - OVAL Miscellaneous Definitions (oval:RHEL5/amq-clients-1.oval.xml.bz2)
    - OVAL Patch Definitions (oval:RHEL5/jboss-eap-6.oval.xml.bz2)
    - OVAL Miscellaneous Definitions (oval:RHEL5/satellite-tools-6.2.oval.xml.bz2)
    - OVAL Patch Definitions (oval:RHEL5/satellite-tools-6.3.oval.xml.bz2)
    - OVAL Patch Definitions (oval:RHEL5/satellite-tools-6.4.oval.xml.bz2)
    - OVAL Patch Definitions (oval:RHEL5/satellite-tools-6.5.oval.xml.bz2)
(...)

$ golie clone --loglevel=info --filter OpenShift.*4 \
             https://atopathways.redhatgov.io/compliance-as-code/scap/feed.json
INFO Downloading https://atopathways.redhatgov.io/compliance-as-code/scap/feed.json
INFO Downloading https://atopathways.redhatgov.io/compliance-as-code/scap/ssg-ocp4-xccdf.xml
INFO Downloading https://atopathways.redhatgov.io/compliance-as-code/scap/ssg-ocp4-ds-1.2.xml
INFO Downloading https://atopathways.redhatgov.io/compliance-as-code/scap/ssg-ocp4-ds.xml