Re: Compiled list (STIG for Debian)

[Stephanie Hall <shall@oteemo.com>]

Thank you everyone!  We found a SCAP Security Guide (SSG) for each of the 3 versions we were looking at.  9-11.   It's not a STIG, but SCAP is a DoD industry standard so they should look favorably on it. <fingers crossed>  All three had the same line items. We broke it out into an excel spreadsheet that I wanted to share with you since not everyone uses SCAP.  

Thanks for the help!  

On Wed, Mar 2, 2022 at 1:23 PM Stephen Dowdy <sdowdy@ucar.edu> wrote:

On 3/2/22 10:54, Jeremiah C. Foster wrote:
> Cannot speak for it's provenance, but there's this; https://github.com/hardenedlinux/STIG-4-Debian

Jeremiah,

Thanks, that actually looks like more of an SRR (System Readiness Review[0]) evaluation checker for applicable STIGs.

As it states, it uses the RHEL7 STIG as a baseline for the tests.

While old (2017), it might still prove useful if it can identify CAT I issues quickly with few false negatives as a *starting point*

--stephen
[0] i think DISA stopped making these scripts due to the burden of keeping them upto date.   3rd parties now do that for $$$$

--

Stephanie Hall

Oteemo, Inc.

Sr. Consultant, Cybersecurity

m: (315)-723-9951

e: shall@oteemo.com

Oteemo Customer Love

 

Attachment: Debian_9-11_SSG.xlsx
Description: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet