Thank you everyone! We found a SCAP Security Guide (SSG) for each of the 3 versions we were looking at. 9-11. It's not a STIG, but SCAP is a DoD industry standard so they should look favorably on it. <fingers crossed> All three had the same line items. We broke it out into an excel spreadsheet that I wanted to share with you since not everyone uses SCAP.
Thanks for the help! On Wed, Mar 2, 2022 at 1:23 PM Stephen Dowdy <sdo...@ucar.edu> wrote: > On 3/2/22 10:54, Jeremiah C. Foster wrote: > > Cannot speak for it's provenance, but there's this; > https://github.com/hardenedlinux/STIG-4-Debian > > Jeremiah, > > Thanks, that actually looks like more of an SRR (System Readiness > Review[0]) evaluation checker for applicable STIGs. > > As it states, it uses the RHEL7 STIG as a baseline for the tests. > > While old (2017), it might still prove useful if it can identify CAT I > issues quickly with few false negatives as a *starting point* > > --stephen > [0] i think DISA stopped making these scripts due to the burden of keeping > them upto date. 3rd parties now do that for $$$$ > -- Stephanie Hall Oteemo, Inc. <https://oteemo.com/> Sr. Consultant, Cybersecurity m: (315)-723-9951 e: sh...@oteemo.com <https://www.linkedin.com/in/stephaniewilliamsatignitemktg/> <https://twitter.com/ignitemarketing> Oteemo Customer Love <https://oteemo.com/what-our-clients-say/>
Debian_9-11_SSG.xlsx
Description: MS-Excel 2007 spreadsheet
