CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Automated STIG “Hardening” Finally Comes to
Government IT
For the thousands of hard-working men and women responsible for securing government IT
networks to the Defense Information Systems Agency’s mandatory “STIG” standards, the task
can be daunting and even somewhat thankless.
That is because the STIGs (Security Technical Implementation Guides) outline hundreds of pages
of detailed rules that must be followed to properly secure or “harden” the government computer
infrastructure.
Given that this work is typically a manual process, it can be extremely tedious and time consuming
for IT personnel. In fact, it is estimated that the government spends hundreds of millions annually
to remain in compliance with the STIG standards.
So, as new software tools enter the market that automate the process to near push-button
simplicity, the first reaction after “sounds too good to be true,” is considerable relief.
By automating the process, a task that once took weeks – or even months – can be completed in
a few hours across all endpoints. Ongoing security updates are also automatic and can be
completed in minutes.
Explaining the STIGs
To be fair, there can be a considerable “fog” surrounding the STIGs.
The STIGs essentially exist because government networks are largely built using commercial
operating systems (Windows/Linux), database management systems, web servers and other
network devices. The STIGs, therefore, define alterations in operating environment settings so
these environments can be configured in the most secure manner possible.