Author Archives: Russell Doty

About Russell Doty

A technology strategist and product manager at Red Hat, working on the next generation of open source systems.

Skills Mastery

You go through a series of stages when learning a new skill. Let’s  look at these stages, covering both the characteristics and the implications of each stage. It is helpful to understand a framework for skill levels, what level you … Continue reading

Posted in Uncategorized | 1 Comment

Report on IoT (Internet of Things) Security

IoT (Internet of Things) devices have – and in many cases have earned! – a rather poor reputation for security. It is easy to find numerous examples of security issues in various IoT gateways and devices. So I was expecting … Continue reading

Posted in Security | Leave a comment

What Can We Do About Superfish?

Perhaps the greatest question about Superfish is what can we do about it. The first response is to throw technology at it. The challenge here is that the technology used by Superfish has legitimate uses: The core Superfish application is … Continue reading

Posted in Security | Leave a comment

Superfish – Man-in-the-Middle Adware

Superfish has been getting a lot of attention – the Forbes article is one of the better overviews. Instead of jumping in and covering the details of Superfish, let’s look at how it might work in the real world. Let’s … Continue reading

Posted in Security | 5 Comments

SCAP Workbench

SCAP Workbench allows you to select SCAP benchmarks (content) to use, tailor an SCAP scan, run an SCAP scan on a local or remote system, and to view the results of a scan. The SCAP Workbench page notes: The main … Continue reading

Posted in Security, System Management | Leave a comment

Running SCAP Scans

The previous article introduce SCAP Content, which can be used to drive automated audits. OpenSCAP can be run from the command line, but there are easier ways to do it. OpenSCAP support has been integrated into Red Hat Satellite and … Continue reading

Posted in Security, System Management | Leave a comment

Security Tests – SCAP Content

The previous article introduced SCAP technologies. While the SCAP technologies are interesting, they have limited value without security content – the actual set of security tests run by SCAP. Fortunately there is a good set of content available that can … Continue reading

Posted in Security | Leave a comment

SCAP Component Technologies

The previous article introduced the concept of security guides as executable content and introduced SCAP. We’re going to dig into SCAP in a fair amount of detail. So, let’s start by covering the various technologies that make up SCAP: XCCDF … Continue reading

Posted in Security | Leave a comment

Security Audit Automation Made Easy with SCAP

The last article introduced the US National Checklist Program. Security automation can be defined as the use of standardized specifications and protocols to perform specific common security functions. Which leads us to SCAP – the Security Content Automation Protocol, an … Continue reading

Posted in Security | Leave a comment

Security Checklists and the US National Checklist Program

The last article introduced the need to automate security. If you are going to perform a security audit you need a checklist. Let’s spend a minute on this. If you want a predictable outcome, you need a standard process – … Continue reading

Posted in Security | Leave a comment