mod1 SRGs and STIGs mod1 SRGs and STIGs links ReadOnlyText pageLocation Page x of y helpBtn Help Help HelpButtonClicked exitBtn Exit Exit ExitButtonClicked resourcesBtn Resources Resources ResourcesButtonClicked hideCCBtn Hide Captions Hide Captions HideCCButtonClicked showCCBtn Show Captions Show Captions ShowCCButtonClicked turnAudioDescriptionsOffBtn Turn Audio Descriptions Off Turn Audio Descriptions Off AudioDescriptionsOffButtonClicked turnAudioDescriptionsOnBtn Turn Audio Descriptions On Turn Audio Descriptions On AudioDescriptionsOnButtonClicked skipReverseBtn Skip Backward Skip Backward SkipReverseButtonClicked skipForwardBtn Skip Forward Skip Forward SkipForwardButtonClicked replayBtn Replay Replay ReplayButtonClicked transcriptBtn Transcript Transcript ShowTextButtonClicked pauseBtn Pause Pause PauseButtonClicked resumeBtn Resume Resume ResumeButtonClicked previousPgBtn Back Back PreviousButtonClicked nextPgBtn Continue Continue NextButtonClicked disastig01_00 1 Welcome to Security Requirements Guides, SRGs, and Security Technical Implementation Guides, STIGs. Please take a moment to review the interface features available to you. Closed captioning is currently on. To turn it off, select CC. For an audio description of the visuals on each screen, select the audio description feature. To view a full transcript of the audio for a screen, select Transcript. If you need any assistance with navigation, technical issues, or assistive technology, select Help. At the conclusion of each screen, select next to continue. Select Next now to proceed. disastig01_01 2 IA, Information Assurance SRG, Security Requirements Guide STIG, Security Technical Implementation Guide Information system security is crucial, but rapidly changing technology and sophisticated hackers have made it increasingly complex. If you are a stakeholder in Department of Defense, or DoD, Cyber Security, how do you protect your systems from intruders and configure your systems for maximum security? If a security breach happened, would you know how to respond? How do you set up your systems so that they will be certified to handle DoD information? How do you assess your systems for continued compliance with government information assurance, or IA, requirements? If you are developing new software applications, how can you be sure they will meet DoD IA requirements? To ensure that all information systems meet specific IA standards, the DoD has mandated that systems be configured in accordance with DoD-approved security guidelines. You can find these guidelines in security requirements guides, or SRGs, and in security technical implementation guides, or STIGs. Remember, the use of an SRG or STIG is mandatory according to DoD policy; these are not simply recommendations. By the end of this course, you will be able to identify the purpose of SRGs and STIGs, and will understand when to use each one. disastig01_02 3 SRG, Security Requirements Guide STIG, Security Technical Implementation Guide disastig01_02_01 3 SRG There are four Core SRGs. These provide general security guidelines for operating systems, network infrastructure, applications, and non-technical policy controls. These four Core SRGs are the highest level SRGs and govern specific technology and policy areas. Core SRGs contain all security requirements for their technology and policy areas. Technology SRGs are subordinate to the Core SRGs. Technology SRGs do not refer to a specific product or product version, but contain all requirements that have been flagged as applicable from the parent level Core SRGs. The technology SRGs provide the basis for product-specific STIGs. In this way, SRGs compile overarching technology-specific security settings to help provide assurance that DoD information systems operate at an acceptable level of risk. Note that the Core SRGs are not intended for use in assessments. STIGs, or, if necessary, Technology SRGs will be used for assessments. disastig01_02_02 3 STIG STIGs document DoD policies and security requirements for specific technical products, as well as best practices for configuration. You can find specific STIGs that cover widely used operating systems, infrastructure services, and support applications. There are also STIGs that cover general topics such as remote or wireless computing and networking. Note that STIGs have not yet been created for specific mission applications. So what are SRGs and STIGs? Who needs them and how can they help you secure your information systems? SRGs provide general security compliance guidelines. They serve as source guidance documents for STIGs. STIGs document applicable DoD policies and security requirements for specific technical products, as well as best practices and configuration guidelines. Select SRG or STIG to learn more about each. disastig01_03 4 SCAP, Security Content Automation Protocol Because STIGs can help you detect, or even avoid intrusions, respond to and recover from security breaches, and implement specific security policies for technical products incorporated into your information system, your system is more likely to operate at an acceptable level of risk. A STIG is more than just a text document. STIGs include detailed guidelines to configure systems for security and compliance, such as benchmarks, which are specific versions of STIG content with code to perform automated assessment checks. STIGs also include guidance documents that you can use to configure your system manually. In order to standardize the automation of compliance reporting, the code in these benchmarks is compatible with the Security Content Automation Protocol, or SCAP. Note that in the past, STIGs and their associated checklists were separate documents, but they are now included in a single document that contains both content you can use to configure systems for security and compliance and content you can use to check systems for security and compliance. Although conversion efforts began in 2009, you may still encounter older STIGs with checklists that are separate documents. disastig01_04 5 DISA, Defense Information Systems Agency FSO, Field Security Operations http://iase.disa.mil/stigs/vendor_process/index.html; For an active link to this website, go to the Resources page. DSAWG, Defense IA/Security Accredidation Working Group CIAE, Chief Information Assurance Executive disastig01_04_01 5 The STIG Community DISA, Defense Information Systems Agency NSA, National Security Agency OSD, Office of the Secretary of Defense NIST, National Institute of Standards and Technology http://iase.disa.mil/stigs/news.html; For an active link to this website, go to the Resources page. Anyone who uses a STIG becomes a member of the STIG community and has a role to play in the development and maintenance of STIGs. The standing STIG community includes representatives from DISA, the National Security Agency, or NSA, the Office of the Secretary of Defense, or OSD, Combatant Commands, Military Services, the National Institute of Standards and Technology, or NIST, and other organizations. You may become a member of the STIG community and participate in the STIG development process by subscribing to STIG NEWS. A wide variety of STIGs are currently available and new STIGs are released each year. But where do STIGs come from? How are STIGs developed and what role do you have in their development? Each September, Defense Information Systems Agency, or DISA, Field Security Operations, or FSO, decides which new STIGs should be written and which existing STIGs should be updated. It bases these decisions on market trends, technological changes, customer requirements, and DoD policy and guidance. Vendors who wish to develop a STIG for their product need to complete a Vendor Intent form and return it to the DISA FSO STIG Customer Support Desk. After FSO creates a new STIG, it disseminates it to the STIG community in a draft form. You may become a member of the STIG community and participate in the STIG development process. The STIG community evaluates and comments on the draft STIG during a two-week comment period and a one-day technical interchange meeting. After the comment period and meetings are completed, the draft STIG is presented to the Defense IA Security Accreditation Working Group, or DSAWG, for endorsement of used. If you become a member of the STIG community, you should continue to provide feedback that can be incorporated into the STIG the next time it is updated. Select STIG Community to learn more about the various roles in the development and maintenance of STIGs, as well as how to join the STIG community. disastig01_05 6 http://iase.disa.mil; For an active link to this website, go to the Resources page. Whether operating a current system or implementing a new system, STIGs and SRGs provide important security guidelines and configuration resources for both system operators and developers. The check content presented in STIGs will allow you to assess whether your current systems are in compliance with the STIGs, while the fix text content in the STIGs will help you configure new and existing products so they meet compliance requirements. Vendors should use STIG guidelines for both new and existing products during research and development efforts. But what if an appropriate STIG does not exist? If there is no product-specific STIG for your product, you should use an appropriate SRG to guide you in implementing the appropriate security requirements. While FSO primarily uses SRGs as the basis for writing product-specific STIGs, vendors may use SRGs to build more secure products that comply with DoD security standards. SRGs, STIGs, benchmarks, and other information security-related provide instructions on how to use and apply the guidance it contains. disastig01_06 7 Knowledge Check 1 500 425 then select Submit.]]> DoD policy recommends - but does not require - the use of SRGs and STIGs. True False Correct. DoD requires the use of SRGs and STIGs. Incorrect. DoD requires the use of SRGs and STIGs. If there is no existing STIG to perform an assessment for a product then that product may not be used. True False Correct. If there is no existing STIG, Technology SRGs may be used instead to perform an assessment on that product. Incorrect. If there is no existing STIG, Technology SRGs may be used instead to perform an assessment on that product. SRGs should be used to develop new products when specific STIGs do not exist. True False Correct. When specific STIGs do not exist, you should use SRGs to develop new products. Incorrect. When specific STIGs do not exist, you should use SRGs to develop new products. Now take a moment to check your understanding. disastig01_07 8 http://iase.disa.mil; For an active link to this website, go to the Resources page. By now you should be able to identify the purpose of Core SRGs, Technology SRGs, and STIGs, and you should know when to use them. Remember, Core SRGs provide general security compliance guidelines. Based on Core SRG guidance, Technology SRGs are used by developers to build STIGs, which themselves document applicable DoD policies and security requirements for specific technical products. STIGs also include best practices and configuration guidelines. STIGs are created by DISA in partnership with the STIG user community. DISA encourages community feedback on both existing and potential new SRGs and STIGs. Remember, also, when to use SRGs and STIGs. You should use Core SRGs for general security compliance guidance. Both Core SRGs and Technology SRGs will provide guidance for product development. You can use STIGs to assess whether your current systems are compliant with DoD security requirements and configuration guidance and, also, to determine how to configure new products. If there is no product-specific STIG for your product then you should make use of a technology-specific SRG and use its guidelines to perform your certification or security assessment. Finally, remember that all of these resources are disastig01_08 9 To print a certificate of completion, enter your name in the space provided, and select Print Certificate.