DoD STIG compliance?

David Hoskins

unread,

Mar 22, 2018, 2:30:00 PM3/22/18

to security-onion

I am currently in the Army and about to go through a DISA level security inspection. I have finished securing the rest of the environment and am now about to tackle a security onion server. I am faced with the question of "is this a good idea?" Has anyone attempted to lock one of these down by DoD standards? Is it necessary?

My initial thought is to put it on FreeIPA in order to comply with the authentication portion, but not much else. Has anyone been through one of these inspections with a SO server? What happened?

Thanks

-Dave

Doug Burks

unread,

Mar 22, 2018, 3:12:13 PM3/22/18

to securit...@googlegroups.com

Hi Dave,

I can tell you that Security Onion has an Army Certificate of
Networthiness (CoN) if that helps.

> --
> Follow Security Onion on Twitter!
> https://twitter.com/securityonion
> ---
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at https://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.

--
Doug Burks

Jay Hawk

unread,

Mar 22, 2018, 10:05:52 PM3/22/18

to security-onion

Hi David,

This will depend on the policies of your command and the level of risk they are willing to accept for it to be added to their approved software list. This should go without saying but, when connected to the DODIN, never add software to a network that you have not verified is approved.

Also, there are STIGs for RHEL but (to my knowledge) not for Ubuntu or SecurityOnion. https://iase.disa.mil/stigs/scap/pages/index.aspx

That said, if you send me a message from your .mil email address I can provide you with some additional information. As SOP's and TTP's would at a minimum be considered For Official Use Only and should not discussed in a public forum.

id1010terror [at] gmail [dot] com

Thanks,
Jay

David Hoskins

unread,

Mar 26, 2018, 9:35:34 AM3/26/18

to security-onion

No offense, but not really. In the CON it says that I should essentially give my best effort to lock down UBUNTU. Is there a certain way to lock this up without breaking functionality?

I do have RHEL and CENTOS vm's that are locked up tight. Can I install an instance of SO to it? Will it be more trouble than it is worth?

Thanks

David Hoskins

unread,

Mar 26, 2018, 9:37:57 AM3/26/18

to security-onion

Roger

There isn't any current guidance on Ubuntu. For anyone in the future reading this, I would say to use the general OS guidance if the DAA isn't willing to accept SO as is.

Reply all

Reply to author

Forward