genuine question: Why use STIG Viewer in the first place?”

 

This is the tool DISA uses to conduct line by line audits of manual & automated results during readiness inspections.

 

We use it for regular internal review of STIG posture, benchmark and manual, in order that we are familiar with the tool. It provides a common tool to use between the various customers locally that require and review the information to determine the security posture of their own systems. There may be other tools that may in fact be better, but I’d much rather be familiar and competent with what the auditors will use when crawling over the systems.

 

Thanks,

 

Mark Salowitz, CTR

CTS II PaaS Engineer

USCG Operations Systems Center

 

From: Shawn Wells <shawn@redhat.com>
Sent: Tuesday, November 27, 2018 6:22 PM
To: scap-security-guide@lists.fedorahosted.org
Subject: [Non-DoD Source] Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019?

 

 

 

On 11/27/18 2:06 PM, James Ralston wrote:

I apologize if this is a little off-topic for this list, but a
question: what are others who use STIG Viewer planning to do once
Oracle JDK 8 / JavaFX go EOL in January 2019?
 
Any Oracle Java 8 security updates released after January 2019 will
require a commercial support license from Oracle:
 
    https://developers.redhat.com/blog/2018/11/05/migrating-from-oracle-jdk-to-openjdk-on-red-hat-enterprise-linux-what-you-need-to-know/
 
STIG Viewer requires Oracle JDK 8 and JavaFX 8 in order to function.
Oracle JDK 11 is the next LTS (long term support) version of Java.
(Java 9 and Java 10 are not LTS releases, and are already EOL.)  But
in Java 11, Oracle removed JavaFX:
 
    https://www.infoworld.com/article/3305073/java/removed-from-jdk-11-javafx-11-arrives-as-a-standalone-module.html
 
The OpenJFX project provides a JavaFX 11 implementation that works
with OpenJDK 11:
 
    https://openjfx.io/
 
But: I tested the latest STIG Viewer (version 2.8) with OpenJDK 11 /
OpenJFX 11, and it does not work; it simply crashes at startup.
 
This will shortly place all STIG Viewer users in the situation where
they must purchase a commercial support contract from Oracle in order
to run STIG Viewer, because STIG Viewer requires outdated / EOL
technology.
 
I asked DISA/IASE what their intentions were with STIG Viewer in light
of this.  As of 2018-11-27, this was their response:
 
There are currently no plans on creating a non-Oracle java version
of STIG Viewer at this time.  We also have no information regarding
how DoD will be addressing the licensing requirement for Oracle java
going forward.
So.
 
Ideally, I'd like to find a Linux replacement for STIG
Viewer—something that can read, annotate, and write STIG Viewer
checklist (*.ckl) files.  But although SCAP Workbench can load and
check STIGs, unless I'm missing something, it has no support for STIG
Viewer checklist files.


Not being snide, should this come across wrongly.... genuine question: Why use STIG Viewer in the first place?


 
 
I can't be the only person in this boat.  What are others doing?

Wonder if this is something that could be incorporated into Security Central?

/me glances at @Gabe Alford