SCAP Compliance Checker And STIG Viewer Job Aid - CDSE
Defense Security ServiceIndustrial Security Field OperationsNational Industrial Security Program(NISP) Authorization Office (NAO)Getting Started with the SCAPCompliance Checker and STIGViewer Job AidFebruary 2017
RevisionLogDate2017FEB06Revision1.2Description of ChangeUpdated to reflect OBMS Tool Availability
SCAP Compliance CheckerThe SCAP Compliance Checker is an automated compliance scanning tool that leverages theDISA Security Technical Implementation Guidelines (STIGs) and operating system (OS) specificbaselines to analyze and report on the security configuration of an information system. The toolcan be run locally on the host system to be scanned, or scans can be conducted across a networkfrom any machine on the domain. In either scanning environment, the following requirementapplies: The user conducting the scan must have administrative privileges on the machine to bescanned. If the machine to be scanned is not hosting the tool, domain-level administrativeprivileges (or individual local administrator accounts) are required to remotely scan other systemson the network.Obtaining the SCAP ToolThe SCAP Compliance Checker can be obtained in two ways, depending upon thepossession of a DoD PKI token:PKI enabled: Navigate to DISA’s Information Assurance Support Environment (IASE)webpage at the following px , and scroll to the bottomsection titled “SCAP Tools”. Identify the appropriate version of the tool that corresponds to the OperatingSystem that will host the application, and provide your PKI credentials whenprompted to start the download of the ZIP file.Non-PKI Enabled: Navigate to the DSS ODAA Business Management System via NCAISS atthe following URL: https://ncaiss.dss.mil Log into OBMS using your appropriate credentials Once logged into OBMS, navigate to the top of the home page and click on“ODAA Bulletin Board”. Click on “Headquarters Bulletin Board” under the Headquarters section.
In the Headquarters bulletin board, click on the forum post with the titlecorresponding to the SCAP Compliance Checker installer you require (e.g.“SCAP Compliance Checker Applications – Windows”). Download the ZIP file, unarchive, and install the application.Installing the SCAP Compliance Checker:Within the ZIP file for each Operating System version of the SCAP Compliance Checker isan included PDF, instructing the user on the appropriate way to install and configure thesoftware executable on the host system. The user will need to be logged onto the system asan Administrator in order for the package to install correctly.STIG ViewerThe STIG Viewer is a Java-based application that will be used in conjunction with the SCAPCompliance Checker scan results in order to view the compliance status of the system’s securitysettings. The STIG Viewer can also be used in a manual fashion (e.g. without SCAP tool results)to conduct a manual audit of information system security controls. Use of the viewer does notrequire administrator privileges, provided that the required software packages to support Javaapplications have been installed on the system.Obtaining the DISA STIG Viewer (Version 2.4.1)The DISA STIG Viewer is an unclassified, non-PKI controlled tool that can be accessed anddownloaded on DISA’s IASE website at the following URL: nce.aspxThe tool requires no installation, and runs as a Java application from any directory on the hostmachine.Operating System BaselinesThe STIG Viewer leverages operating System baselines to generate checklists used forvulnerability assessments. These baselines are version- specific, so ensure that you download theappropriate baseline for the operating system you wish to assess. For purposes of viewing scanresults of machines other than the host machine, download the baseline representing the scanned
system’s architecture. The baselines are unclassified; non-PKI controlled, and can be downloadedby navigating to DISA’s IASE website at the following Scanning with SCAP CC and STIG Viewer1. Open the SCAP Compliance Checker Application.
2. Select the appropriate baseline for the system that is to be scanned. First, click Edit - Content and Options:3. Next check the box for the appropriate baseline that corresponds to the system beingscanned. Also, be sure to designate the scan profile as “MAC-3 Classified”:4. Click OK to save the configuration settings.
5. Initiate the scan of the system as shown below:6. Once the scan has completed, view the directory containing the results of the scan byclicking “Results - Open Results Directory” as shown below:
7. This will open the scan results directory. Take note of the XML file containing “XCCDF”.This is the scan results file that you will import into the STIG Viewer to analyze thecompliance state of the machine:8. Open the STIG Viewer application.9. Once the STIG Viewer application is running, import the appropriate STIG baselinepreviously downloaded in Section 3. First, click “File - Import STIG”:
10. Next, navigate to the directory where you have stored the downloaded baseline. Select theZIP file containing the desired baseline and select “Open”:11. Create a checklist from the STIG baseline you just selected by navigating to the top bar andclicking “Checklist - Create Checklist – Selected STIG(s)”:
12. Import the SCAP Compliance Checker XCCDF scan results file from Step 7. To do this,click on “Import - XCCDF Results File”:13. You can now view the results of the SCAP Compliance Checker scan against the STIGbaseline for your operating system:If you have any questions or concerns, please contact your assigned ISSP, or visit the DSS NAORMF website located at the following address: www.dss.mil/rmf
Compliance Checker and STIG Viewer Job Aid . February 2017 . Revision Log . Date Revision Description of Change 2017FEB06 1.2 Updated to reflect OBMS Tool Availability . SCAP Compliance Checker The SCAP Compliance Checker is an automated
o ACAS Nessus Scan Results (.nessus files) o STIG Viewer Checklist Results (.ckl files) Import SCAP XCCDF XML Results . 8 Using the Import SCAP XCCDF XML Results button, the CART application can import the XCCDF results from the SCAP Compliance Checker (SCC) tool. .
Configuration Management SCAP Benefits: automation reduces manual effort to obtain assessment results, determine corrective actions needed and provides substantial cost savings SCAP mandates a common language that supports easier communication of results with other SCAP system users SCAP supports easier comparison of issue sets between
This chapter describes how to install and launch D-checker. Double-click D-checker.exe, which can be found in the unzipped folder, to launch D-checker. Unzip the D-checker package into a folder of your choice (for example, on the desktop). When you launch D-checker for the first time, a firewall settings dialog box will be displayed.
Shows which Checker is connected, the Job name and if it has been saved, along with results for the most recent image. 2 Checker steps. Click each button in turn to build a Checker application. 3 Image display. Shows live video from Checker or individual images from a Filmstrip. 4 For each Checker step, instructions about what to do next are .
rabbi lawrence charney * sally dickman chase harry chasen * sylvia chasen * jean chason * julius george chason * beatrice checker bill checker boris checker * kathy checker * kathy checker harriet chensky * maurice cherney * mollie cherney * muriel cherney henry chess . philip dolin sol dolin
Center for Development of Security Excellence Page 1 Job Aid: Security Configuration Assessment of Information Systems (IS) . DISA Security Technical . (STIG) Viewer A Java-based application used in conjunction with the SCAP Compliance Checker scans results in order to view the compliance s
Compliance Checker scan results in order to view the compliance status of the system's security settings. The STIG Viewer can also be used in a manual fashion (e.g. without SCAP tool results) to conduct a manual audit of information system security controls. Use of the viewer does not
asset management system is fed to the operational systems and the help desk system, if appropriate. In this scenario, when the deployment team deploys a new piece of gear, whether a PC on a desk or a server in a rack in the machine room, they will take any necessary steps to update the asset management system (much of the task can be updated). Once that happens the asset should immediately .
