Automation of security audits for operating systems using OpenSCAP

Abstract

The security configuration audit of operating systems, managed by the General Directorate of Computing and Information and Communication Technologies, posed a challenge due to the considerable time required for manual reviews and the need to ensure high levels of compliance with internationally recognized security practices and recommendations. In this context, the use of the OpenSCAP tool was evaluated to automate both the review and correction of security configurations. The evaluation was conducted in a test environment with commonly used operating systems at the University. The tool enabled automated audits based on best practices, autonomously applied corrections, and objectively measured compliance levels before and after corrective actions. The results showed that the use of OpenSCAP significantly reduced the execution time of audits. Additionally, the automated corrections applied improved compliance with security recommendations, reaching levels above 90%. However, certain configurations were identified that required manual intervention, particularly those related to boot password management, partition administration, and access control to critical services. These results demonstrated that automation helped reduce operational workload and made verification processes more uniform, without completely replacing the need for human supervision in specific cases. It was concluded that integrating automation mechanisms into institutional procedures contribute to a more efficient model for information security management at the University.