CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

ConfigOS supports over 6,000 standard STIG controls in a wide range of tested content.
However, the software is also designed to allow users to tailor controls to respond to an
application’s requirements.
“We could enforce the STIGs to the letter, but that doesn’t work if it means the application will not
run,” explains Hajost. “So ConfigOS creates an operational policy that is as close to the published
STIGs as possible, but still allows the application to function as designed,” explains Hajost.
The signature containers can then be transported across large and small networks, classified
environments, labs, disconnected networks, and tactical environments with connected and
disconnected endpoints. No other changes are required to the network, security and no software
is installed on any endpoints.
To date, ConfigOS has been licensed by just about every branch of the Department of Defense,
as well as parts of DHS, HHS, and Department of Energy. The product is also used by large
defense contractors and in programs for all branches of the military.
Hajost adds that automation is even more important given that STIG compliance is an ongoing
process with new security updates introduced periodically
The STIGs, for example, are updated every 90 days to account for newly discovered
vulnerabilities as well as changes and updates to by the vendors supplying the major operating
environment components.
With ConfigOS that means that within two business days after DISA publishes a new version of
the STIGs, new tested production content is made available to customers.
“When it is a manual task, security updates to existing applications and operating systems are
typically delayed by months,” says Hajost.
The software can also speed implementation of new network applications, servers and appliances
by evaluating and hardening each prior to installation.
Hajost estimates automating the process reduces initial hardening time by 90%, while reducing
system security policy maintenance expenses by about 70%.
Given the potential cost savings of automating STIG policy compliance exceeds hundreds of
millions of dollars annually, IT personnel struggling to secure government networks manually may
find this one task they are happy to automate.
About the Author
Jeff Elliott is a Torrance, Calif.-based technical writer. He has researched and
written about industrial technologies and issues for the past 20 years.
For more information about ConfigOS from SteelCloud call (703) 674-5500; or
visit www.steelcloud.com.