Sign up for free:
diarmf - implement
STIG Update – April 2019 Quarterly Release
DISA has released the following updated Security Guidance, Security
Readiness Review Scripts and Benchmarks:
Unclassified Application STIGs : http://iase.disa.mil/stigs/app-security/Pages/index.aspx
Adobe Acrobat Professional Document Cloud (DC) Classic STIG, Version 1, Release 2
Citrix XenDesktop 7.x Delivery Controller STIG, Version 1, Release 2
Citrix XenDesktop 7.x License Server STIG, Version 1, Release 2
Citrix XenDesktop 7.x Windows Virtual Delivery Agent (VDA) STIG, Version 1, Release 2
McAfee VirusScan 8.8 Managed Client STIG, Version 5, Release 20
McAfee VSEL 1.9/2.0 Local Client STIG, Version 1, Release 4
McAfee VSEL 1.9/2.0 Managed Client STIG, Version 1, Release 4
Microsoft DotNet Framework 4.0 STIG, Version 1, Release 7
Microsoft Exchange 2010 Edge Transport Server STIG, Version 1, Release 5
Microsoft Exchange 2013 Edge Transport Server STIG, Version 1, Release 5
Microsoft Exchange 2013 Mailbox Server STIG, Version 1, Release 4
Microsoft Exchange 2016 Edge Transport Server STIG, Version 1, Release 2
Microsoft IIS 7.0 STIG, Version 1, Release 18
Microsoft IIS 8.5 Server STIG, Version 1, Release 7
Microsoft IIS 8.5 Site STIG, Version 1, Release 7
Microsoft Internet Explorer 11 STIG, Version 1, Release 17
Microsoft Office System 2013 STIG, Version 1, Release 8
Microsoft SQL Server 2016 Database STIG, Version 1, Release 4
Microsoft SQL Server 2016 Instance STIG, Version 1, Release 5
Microsoft Windows Defender Antivirus STIG, Version 1, Release 5
Mozilla FireFox STIG, Version 4, Release 25
PostgreSQL 9.x STIG, Version 1, Release 5
Web Server SRG, Version 2, Release 3
Unclassified Network STIGs and SRGs: http://iase.disa.mil/stigs/net_perimeter/Pages/index.aspx
BIND 9.x STIG, Version 1, Release 6
IBM MaaS360 with Watson MDM v10.x STIG, Version 1, Release 2
Infoblox 7.x DNS STIG, Version 1, Release 7
Network Infrastructure Policy STIG, Version 9, Release 8
Network WLAN STIG, Version 6, Release 15
Router SRG, Version 3, Release 2
Voice Video Endpoint SRG, Version 1, Release 9
Voice Video over Internet Protocol STIG, Version 3, Release 14
Voice Video Services Policy STIG, Version 3, Release 16
Unclassified Operating System STIGs and Overviews: http://iase.disa.mil/stigs/os/Pages/index.aspx
Active Directory Domain STIG, Version 2, Release 13
Apple OS X 10.3 (Sierra) STIG, Version 1, Release 2
Canonical Ubuntu 16.04 LTS STIG, Version 1, Release 2
Microsoft Windows Server 2008 DC STIG, Version 6, Release 43
Microsoft Windows Server 2008 MS STIG, Version 6, Release 42
Microsoft Windows Server 2008 R2 DC STIG, Version 1, Release 30
Microsoft Windows Server 2008 R2 MS STIG, Version 1, Release 29
Microsoft Windows Server 2012/2012 R2 DC STIG, Version 2, Release 16
Microsoft Windows Server 2012/2012 R2 MS STIG, Version 2, Release 15
Microsoft Windows Server 2016 STIG, Version 1, Release 8
Oracle Linux 6 STIG, Version 1, Release 15
Red Hat Enterprise Linux 6 STIG, Version 1, Release 22
Red Hat Enterprise Linux 7 STIG, Version 2, Release 3
Solaris 11 SPARC STIG, Version 1, Release 17
Solaris 11 x86 STIG, Version 1, Release 17
SUSE Enterprise Linux 12 STIG, Version 1, Release 2
z/OS ACF2 STIG, Version 6, Release 40
z/OS RACF STIG, Version 6, Release 40
z/OS TSS STIG, Version 6, Release 40
FOUO HBSS STIGs: https://iase.disa.mil/stigs/hbss/Pages/index.aspx
HBSS ePO 5.3/5.9 STIG Version 1, Release 17
HBSS HIP 8 Firewall STIG Version 1, Release 12
HBSS HIP 8 STIG Version 4, Release 22
HBSS Remote Console STIG Version 4, Release 17
McAfee ENS 10.x STIG Version 1, Release 3
FOUO Network STIGS: http://iase.disa.mil/stigs/net_perimeter/Pages/index.aspx
Joint Regional Security Stack STIG Version 1, Release 5
Microsoft Internet Explorer 11 STIG Benchmark, Version 1, Release 13
Microsoft Windows 2008 DC STIG Benchmark, Version 6, Release 43
Microsoft Windows 2008 MS STIG Benchmark, Version 6, Release 43
Microsoft Windows 2008 R2 DC STIG Benchmark, Version 1, Release 31
Microsoft Windows 2008 R2 MS STIG Benchmark, Version 1, Release 32
Microsoft Windows 2012 and 2012 R2 DC STIG Benchmark, Version 2, Release 16
Microsoft Windows 2012 and 2012 R2 MS STIG Benchmark, Version 2, Release 15
Microsoft Windows Defender Antivirus STIG Benchmark, Version 1, Release 2
Microsoft Windows Server 2016 STIG Benchmark, Version 1, Release 9
Red Hat Enterprise Linux 6 STIG Benchmark, Version 1, Release 23
Red Hat Enterprise Linux 7 STIG Benchmark, Version 2, Release 3
Solaris 11/SPARC STIG Benchmark, Version 1, Release 11
Solaris 11/X86 STIG Benchmark, Version 1, Release 11
STIG Update – Group Policy Objects (GPOs) for Security Technical Implementation Guides (STIGs) – April 2019
Group Policy Objects (GPOs) have been updated for April 2019. See the Change Log document included in the zip file for additional information.
DISA Risk Management Executive is posting the GPOs for use by system administrators to ease the burden in securing systems within their environment.
The GPOs can be found on IASE website on the Group Policy Objects tab located at this link: https://iase.disa.mil/stigs/gpo/Pages/index.aspx
List of GPOs currently in the package:
Adobe Acrobat Pro DC Classic
Office system 2013
Internet Explorer 11
Windows Server 2008 R2 MS
Windows Server 2008 R2 DC
Windows Server 2012 R2 MS
Windows Server 2012 R2 DC
Windows Server 2016 MS
Windows Server 2016 DC
Windows Defender AntiVirus
For all STIG related questions, please contact the DISA STIG Customer Support Desk: email@example.com
Check out the courses at: https://securitycompliance.thinkific.com
Here is the POAM template I was looking at:
PM-4 PLAN OF ACTION AND MILESTONES PROCESS
a. Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:
1. Are developed and maintained;
2. Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
3. Are reported in accordance with OMB FISMA reporting requirements.
b. Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
What to know more about how I get all these opportunities:
Interested in this position?
-This position requires US Citizenship with a current DoD Secret Clearance
-4+ years of experience directly related to Linux System Administration in a sustainment environment; strong background in Red Hat Enterprise Linux (RHEL 5/6)
-VMware Horizon, VApps, VMware vSphere Clusters and vCenter Servers
-Basic Network Administration knowledge utilizing CISCO
-Understanding of Storage Area Network concepts (SAN) and Network Attached Storage (NAS)
-Knowledge of patch management tools such as RPM and YUM package management, Red Hat Satellite.
-Experience in COTS/GOTS/FOSS software installations
-Background in applying STIG settings to each product or underlying OS
-scripting languages such as Powershell and PowerCLI, Bash, Ruby, and Python
-automation tools such as Chef, Puppet, SaltStack
-Knowledge of storage systems such as EMC VNX
-Knowledge of Active Directory services, LDAP
This position is responsible for troubleshooting, maintaining and implementing solutions to optimize the infrastructure operations. The candidate will be responsible for designs, implements, codes, tests, documents, and maintains systems integration solutions.
check out my courses:
the job in this video:
Job Title: Information Systems Security Officer
Location: Sunnyvale, CA
Duration: 6 Months (Possible extension)
Performs system and program auditing to ensure compliance to system security plan.
Conducts risk assessments and provides recommendations for secure implementation and compliance in accordance with government regulations and information assurance/cybersecurity guidelines. Creates, maintains and submits information system security documents and reports to regulatory agencies and leadership.
Assesses and mitigates system security threats/risks throughout the program life cycle; validates system security requirements definition and analysis; establishes system security documentation; assists with the implementation of security procedures; verifies information system security requirements; performs information system certification and accreditation planning, testing, assessing and liaison activities.
Familiar with information system security architectural documentation standards.
Able to apply information assurance / cyber security standards, directives, guidance and policies to an architectural/risk based framework.
Provide architectural / risk based analysis of information assurance / cyber security features and relate existing system to future needs and trends and requirements.
Windows client/server background. Some UNIX/LINUX technical experience, knowledge of OS security requirements and IS (Information Systems) auditing experience.
HBSS and SIPRNet experience required.
Previous ISSO and SIPRNet experience needed.
Bachelor or equivalent work experience.
Please provide the following information
Alternate contact (if any):
Kindly share your detailed resume at firstname.lastname@example.org
If you are qualified and interested in making a change or know of a friend who might have the required qualifications, please call me ASAP at (703) 261-7028 Ext.267, even if we have spoken recently about a different position. If you do respond via e-mail please include a daytime phone number so I can reach you. In considering candidates, time is of the essence, so please respond ASAP. Thank you.
8251 Greensboro Drive, Suite 250
(703) 261-7028 Ext.267