How to evaluate server against final DISA STIG?

Truhn, Chad M CTR NSWCDD, CXA30 chad.m.truhn.ctr at navy.mil
Thu Jul 18 17:29:26 UTC 2013


To the best of my knowledge, DISA has not released a "benchmark" for the RHEL6 STIG.  I know there is not one on the iase.disa.mil site.  It's all a manual process for now using the "manual" STIG and then checking each item yourself.  It's actually not that bad though, compared to the other STIGs.

The DISA benchmarks that they do release (for RHEL5 for example) are far from complete anyway.  There are 569 checks in the manual STIG for RHEL5 and the benchmark only accounts for 350 of them.  If you are just running the scan, you are missing 219 checks that are required.  Solaris is even worse.

SSG does have content for RHEL6, but I don't believe DISA has released any corresponding content.  It sucks...

I would be happy to be wrong here though if anyone knows something I don't.

Good Luck,
Chad

-----Original Message-----
From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Andrew Gilmore
Sent: Thursday, July 18, 2013 12:57 PM
To: scap-security-guide at lists.fedorahosted.org
Subject: How to evaluate server against final DISA STIG?

I appreciate all the great work folks have done, and somehow missed
the big announcement that DISA had put a final out there.

Now, I'd like to evaluate against the final STIG, from
http://iase.disa.mil/stigs/os/unix/red_hat.html.

It appears that the profiles listed are fairly different than the SSG
version, but I can get behind that. I can try MAC-3_Public to start.
What I don't see is the CPE dictionary, etc. Where do I get evaluation
content to match the DISA STIG?

Thanks,
Andrew
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list