SCAP & STIG Tutorial

[@sunniesonnie]

This video was a life saver. I normally manage VTC and Webex but now my boss wants me to start STIGing which I know nothing about and now, thanks to you, I get it :)

[@Ruffgemm]

This is golden… and you’re not charging… this is someone’s interview success tool. Stg

[@tech-time-videos]

I've been through that struggle before and understand the pain. As a former job candidate trying to break in to cyber, I realized too I didn't have much funds. Will continue to post when I have time to add more content :)

[@JohnLobato-z3o]

I totally agree with Sonya and Dwayne you did a fantastic job in this video you voice is very clear and your walk through of how to use the SCAP tool and STIGs successfully was amazing. Thank you, This walk through once again was outstanding! Thank you for taking the time to make this video documentation of the process! Really helped me! All the best to you and keep the great videos coming, very helpful! I hope you land and find your contracting job. I think you will be an great asset to any computer company you have incredible knowledge and skills that will always keep you employed. Wishing you all the best for continued success.

[@olusegunbakare5992]

This video is one of the best videos have ever seen out here, very detailed on all steps. Thank you for posting.

[@dwaynetoney3429]

Thank you, thank you, thank you!!!!!! This walk through was outstanding! Thank you for taking the time to video document the process! Really helped me! All the best to you and keep the great videos coming, very helpful!

[@leomcnamara8711]

Superb video! MANY thanks from those of us who have to slog through this STIG stuff, and are looking to automate the process as much as possible.

[@tech-time-videos]

Check out SteelCloud ConfigOS, Ansible for Redhat, or Puppet.

[@alanandrews7403]

OMG, thanks, I was manually fixing these one at a time 😂. You saved me hours! Keep up the great work.

[@faizankhanseo4639]

🤣

[@makp912]

Your videos are great! Thank you for posting.

[@mrobinson75]

Grate run through on the stig viewer and the dod still application.

[@richard90153]

Around 12:09 mark the Video presenter used the term "Macly" (not sure how to spell it but I assume its an acronym for something.) . Can anyone provide more details on it?

[@johnhart6320]

He actually said "Automatically"

[@richard90153]

@@johnhart6320 Ahhh Thank you!

[@jkmattbiz]

This is a really good explanation of how STIG's work. I'm wondering if you have another video that I could use. We have new switches/routers inbound, like 70 in total and I'm tasked with STIG'ing them. I know I need to harden them and get them ready to replace the old equipment but I'm thinking that we can probably set up a script file and manually install all the compliance needed when they arrive individually. I'll see if you have more video's, thanks for this one. Surprised you have only 116 followers, this is brilliance and more people should know about you

[@tech-time-videos]

Look into Cisco Ansible for automating the switches/routers. Unfortunately this is outside of my expertise at this time. Otherwise you can always copy and paste manually into a text file from all the applicable manual cisco STIG checklist for router/switch and that’s the only way I know how to STIG them now. public.cyber.mil/stigs/supplemental-automation-content/

[@jkmattbiz]

@@tech-time-videos I wrote this review 2 months ago and only watched half of your video. Now I finished your entire video and think it's even better than before. Not sure you needed any automation or Ansible for Windows because it looks like it fixed all your "RED" findings for you? I'm exhausted today so I think I'll just RE-watch this tomorrow morning and see if I can't implement all of this with the CISCO 9300 switch sitting next to me. I need to harden it and we have a bunch more to do. I'm playing with this one so I guess I'm trying to come up with something to STIG all of them faster. Tedious process it seems. I'll have tons of coffee in the morning, thanks again for your video. Maybe someone out there can comment on a link to any SWITCH hardening STIG'ing they have seen on KZbin.

[@tech-time-videos]

@@jkmattbiz I'm not a much of a network guy. Just know how to bang into it and look around. If you figure it out, let me know! The way I've seen this done is whoever the admin STIG'ing it can also copy all the commands into notepad and delete the hostname of the switch to whatever they named it, then paste it all in. This is maybe a 30-45 min process. Not sure.

[@jkmattbiz]

@@tech-time-videos definitely will follow up when I get this figured out. That is what I'd like to do to automate this process and build out a script to run on each switch. My supervisor said you can use that SCAP tool that you did on Windows and Linux configurations but he's not sure if Cisco Catalyst switches have that same option and we'll need to manually submit each command line interface commands initially and then possibly plug in the remaining switches and just run the script, like the notepad you were talking about. Thank you

[@jam2mc45]

Hi, I am fairly new at STIGing thank you for the simple explanation of how everything work. One question I had is when you forced the LGPO is that something that can be used on active devices when you have hundreds on non compliant results, and if so is there a LGPO for all benchmarks or just the windows 10. My sites include multiple benchmarks such as .Net, windows storage server, IE, Chrome, ETC. Sometimes I end up with a few hundred Non reviewed and CAT 2 and quite a few CAT 1 on older systems.

[@tech-time-videos]

@jam2 for the video, I only did this on the windows 10 host. If you are pushing policy from the domain down using group policy management, you can force the occasion by using the /force switch on the clients (windows 10) I only shared how I would accomplish this locally but the gpo store you want to create a store for the templates. learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/create-and-manage-central-store

[@CyberOptek]

Question please. Lets say you have finished checking all the windows stigs and a new version of the stig is released. How do you merge what you've already done with the new STIGs so that you can see what is different and not have to go back and redo all of them again? That's one thing I cant seem to figure out.

[@tech-time-videos]

I would import the latest STIG first. Then have your previous checklist saved and ready. When you create a new checklist with the latest STIG, there is a import checklist data feature, where you can copy the previous Findings and Comments so you don't have to reinvent the wheel. Track all differences if new STIGs come up or view change history from the original zipped folder.

[@CyberOptek]

@@tech-time-videos holy cow....thank you so much. I got thrown into this a couple of months ago and with the help of your video was able to get my initial STIGs and GPOs done. However the have released new stuff since then and I could not figure out how to merge the old into the new. This is a huge help so thank you. One other question if I may....when doing the GPOs using LGPO, I would imagine that an AO is going to need to see some proof that those were done? Unlike the StigViewer there isnt a checklist for that. Ive just been copying the text from the command line and putting it into a word document but didnt know if that was necessary or if there is a better way of documenting those processes.

[@tech-time-videos]

@@CyberOptek check this link learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gporeport?view=windowsserver2022-ps you can export GPO into HTML report to show as evidence for a single host and use it as a represenative.

[@CyberOptek]

@@tech-time-videos Huge help...thank you.

[@ЯрославДудкін-й5з]

the most informative video I`ve ever seen, thank you so much

[@wallerdog]

Nicely done! I'm a network guy by trade and have inherited a CRN so now I've got to do everything. This helps alot. However, I'm not getting the current STIG viewer to open in standalone mode. I'm using the command line and running as admin. An older version was installed by someone else and it works so I don't understand why I'm having trouble with the newer version.

[@tech-time-videos]

@wallerdog, the standalone STIG viewer per say 2.14, there are dependencies. When you CD in the directory, do you see the other items? It should work if you have this. Remember you cannot just move the file alone and expect it to open up. It's tied with the folders: bin; conf; legal; lib within that U_STIGViewer_2-12_Win64.

[@billbobaggins8207]

For RMF is there a way to upload the scan results in eMASS or do you have to fill out the exported Excel document that lists all the hundreds of controls by hand?

[@nayanhn]

How or where do we get older versions of SCAP tool example version shown in your video because latest version is not applicable in 32 bit windows machine, So is there any way to get the lesser version then "SCC 5.9 Windows" please let me know it is possible or not

[@superjasim]

Thank you and god bless you for this tutorial. I have a couple of questions if you could please look into it: 1. So what you did in the video (by scanning the example stig benchmark file and opening it with Stig Viewer then fixing the vulnerabilities by using CMD) is that all what stigging & scapping for? Or are there different uses for the Stig & Scap programs? 2. Is there a job position in the IT field that basically ONLY requires the knowledge of using Stig and Scap? So basically all you gotta do in that job is scanning files for possible vulnerabilities and fixing them (like shown in the video) or you are still required to know and use more programs & solve different problems? I would much appreciate the answer & thank you very much

[@JacobBetancourt-v7u]

It worked on my computer but will this interfere with other companies computers. I'm worried this might mess up something if I travel to a company building and it automatically messes something up?

[@nelrheatheanhea]

thanks for the video. Surprising DOD doesn't have anything as simple as this instructions. I used this to apply STIG on RHEL7.

[@erikamallow7511]

Such a lifesaver!!!!! Thank you🙏🏽

[@dec9164]

Thank you for your time & efforts, this is very helpful. Liked & subscribed.

[@1WithJC]

Great presentation in all respects. Do you have a Linux version or plan to create sometime soon?

[@tech-time-videos]

Thanks. Will do once I knockout some other items.

[@TinCanSailor]

Wonderful tutorial. Please keep up the great content.

[@gracestarlavarez]

Is scap an invasive scan or will it disturb network or get alerted?

[@faizankhanseo4639]

You there??? Thank you so much. I wanted to express my gratitude for your help and support today. I have been struggling with all of this for about 2 days and after your video, I did my work in a few minutes and successfully generated reports. I am new in this field and i have a noob question. How can I make these type of reports for CIS Benchmark? Please make some videos for CIS benchmark also.

[@tech-time-videos]

for CIS, try CIS-CAT Lite directly from CIS

[@jeremewright3329]

Do you know when doing stigs for windows server 2016 do you still need to do the gpo/lgpo .exe part?

[@tech-time-videos]

Yes you do need to do that. After that, you want to review the "Not Reviewed" checks that the LGPO can't import. There is also an Active Directory and DNS STIG that you can use to harden that as well. It's a manual process.

[@jeremewright3329]

@@tech-time-videos oh ok… so let’s say before running the gpo policy object. Does that cover group policy editor stigs for windows server 2016?Asking Because I pretty much have followed all the step you did but kind of hesitant on apply gpo policy object because it comes with gpo for Domain Controller and just for server 2016 . I’m not sure which gpo is for which.

[@tech-time-videos]

@@jeremewright3329 The SCAP scores for the Windows Server 2016 will be about 97.92% I believe from my memory with the GPO imports. Once you attach some host machines or if there are computers in the Active Directory, the scores will be less due to various checks. In addition, Domain Controllers have a ton of "Not Reviewed" checks that has to be completed manually.

[@Burchigb]

Hopefully you will be doing something concerning how to fill out PPSM request?

[@aaronstella]

Where can we find Windows 11 benchmarks for SCAP?

[@blaqwestern]

Thank you for this awesome video!!

[@keithmiller1311]

Thank you so much for this video!

[@scuzzynate11]

Anybody have a good way to parse through these files easier? Generating one file per stig check per machine can become a lot to go through. I.E. some way to parse through every single .ckl and find all vulnerable hosts for a given item?

[@tech-time-videos]

Are you using the new STIG Viewer 3.2? There are other 3rd party tools that you can use like Nessus to run compliance scans against the STIG, then export in a spreadsheet.

[@JunaidKhan-kx8ui]

HI Similar to this is there website where I can download CIS hardened GPOs?

[@travelwithme5096]

did you find CIS hardened GPOs ?

[@JunaidKhan-kx8ui]

@@travelwithme5096 Had to make em

[@robsawyer8034]

Are you doing this from the host or in the actual VM? I am running an ubuntu host trying to check a linux VM.

[@tech-time-videos]

These are VMs on my VMworkstation Pro. I'm not that familiar with Linux to be honest. Hoping to tackle that soon and while testing out the ansible.

[@robsawyer8034]

@@tech-time-videos awesome- I’m taking some training which includes ansible shortly

[@Ruffgemm]

I still got a 64.93% what could be the problem. I followed you all the way

[@tech-time-videos]

For SCAP, or for entire STIG checklist after XCCDF import? There are two different things. The GPOs only get you so far and the rest you have to spot check.

[@pervezahmed9687]

Great help by this video and your excellent explanation. I have task to apply stigs on Oracle Linux. would be great if someone can help me.

[@tech-time-videos]

Ask ChatGPT? 😅 use ansible Outside my expertise but I can figure it out.

[@leonardomartins2874]

I need help. I did the whole process but now my AD admin password has been changed. What is the default password after reboot?

[@tech-time-videos]

try X_Admin whatever your domain name is .\X_Admin

[@tech-time-videos]

the GPOs wipe out the username. It doesn't change the password. It changes the default administrator account to username of X_Admin. If you end up locking yourself out, use your installation disc to change X_Admin

[@ericlien]

thank you, quick and easy

[@1delta_10tangos]

Definitely Helpful

[@MicahGreenhalgh]

You rock thanks buddy

[@SvetlozarKosev]

Wow, thank you

[@datrrico]

Well done

[@amirsaeed5634]

Nice video...Good explanation. If you can go a little slow.

[@iamthemoss]

Awesome video, I need to get you more subscribers

[@starfox4919]

Don't make the mistake of not saving your STIG work....talk about a long day

[@tech-time-videos]

Yes. I've done that a few times before lol.