DISA STIG Verison 8 Release 5 - 28 January 2011

All,

I have uploaded the next version of the DISA STIGs to use with your NCM Policy Reporter. These rules and policies will need to be modified for your organizations use and you start to create reports. If you have any questions, comments, suggestions, or feedback please feel free to write me. All correspondence is appreciated and look forward to making this a better product for all.

Thanks,

CourtesyIT

M.S. Management of Technology

CCNA-CCNP-CCDA-CCDP-CCNA Security-CCSP-ITILv2-Security+-SCP

Find more posts tagged with

disa_stig_compliance

disa_stig_complaince_fisma

stig_disa

Accepted answers

All comments

tomkins77

Hello,

CourtesyIT - thanks the STIG reports and rules.

Quick question: For items that require manual checking, e.g. "NET1734 - V17857 - SNMP stored for 30 days". Is the intent of the rule to remind the NetAdmin to manually verify the configuration? If so, once that is complete, should the NetAdmin delete this rule, or add some type of comment within the config file to "confirm" the manual activity?

Thanks!

Tom

CourtesyIT

Tom,

Thank you for the feedback.

My interpretation of the rule is that the Network Administrator is to keep snmp traps on the system for 30 days and back them off on to disk which should be held in a secure storage for 1 year. I was unable to develop a rule to check for this so manual verification was required.

I have reviewed the latest version of the STIGs and have noticed that this particular rule has been deleted. I will be reviewing the stigs and will upload the latest version in a couple of weeks.

Thanks,

tomkins77

CourtesyIT,

Thanks for the response. I will be providing a high-level overview of the NCM product and how to use it for DISA STIG compliance to my teammates early next week. You answers have helped me tremendously. I have imported a few DISA Reports from your templates. I notice that upon importing the XML template, they becomes standalone reports, e.g. one for AAA, IPV4 to IPV6...etc. Whereas, the STIG guides separate out into "Switch L2", "Switch Layer 3", "Routers", "Perimeter router",.etc.

I would like to figure out how to apply custom reports that mirrors the STIG guidelines (Switch L2, Switch L3, perimeter router...etc) to specific groups of Assets, e.g. "Perimeter routers report composed of select rules from your XML templates applied to Router A & Router B." My thought is to import all your DISA templates, then create a custom report with custom policy built from rules created by you XML template import, then associate the report to Router A & Router B. Do you think this will work? Is there a better way to do this?

Thanks Again!

CourtesyIT

Tomkins77,

I broke it down for two reasons:

1. With all the rules for a functional device the report becomes unwieldy.

2. With smaller reports you are able to focus or deligate a particular technology/protocol for remediation.

If you go to my profile you should see some documents that will help you out in developing your functional device reports.

Hope this helps. If you need something else developed feel free to ask.

rlf2210

I tried to import the DISA STIG XML file for the policy report. I tried to up load it through the Import Policy Report, and I get this error

Unable to read xml file or wrong file format.

Is this the proper way to update the STIG?

Robert

CourtesyIT

Robert,

Which report were you looking for? You may also contact me via solarwinds@courtesyit.com.

Thanks,

Courtesyit