So I’m now officially throwing my hat into the blogging ring.  This is my first official “Hello World” to put out there.

Why am I interesting in blogging?  Well, to tell the truth, I’m about as introverted as somebody can get.  I grew up in the backwoods of Idaho, where the population density is something like .5 people/square mile.  My people are known for their actions and not their words.  In our world, it’s nobody’s business what we think, want, or do.

However, when I look around me (I do computer security for a wide variety of US Government agencies), I see lots of things that need fixing.  Don’t get me wrong, the government has lots of good things going for it. Inside DC, there is the highest density of the brightest security managers that anyone could hope for.  Unfortunately, it also has this huge inefficiency and bureaucracy in information security management that sometimes implodes under its own weight.  Since the government has an inertia all to itself, nothing short of a cultural change will fix the few fundamental security problems that it has.

How do we bring about a cultural change?  Well, for starters, you get your thoughts into print and out into the world.  That’s where teaching comes in.  That’s where this blog comes in.  That’s where being published comes in.

I’m now doing 2 of the 3.  I’ll get the third once I have something more formal and polished.

• An Open Letter to the Next President of the United States
• Core Belief #1 — Security is not Different
• Workin’ for the ‘Counters: an Analysis of my Love-Hate Relationship with the CPAs
• Buy a Costume, Get Security Suite Free!
• Learning GovieSpeak: The Plum Book

I’ll be teaching FISMA and the NIST Information Assurance Framework in March and April.  This event is restricted to only government employees.  We go down into significant depth and have numerous exercises.  You come out of the 5 days with the skills needed to function as an Information System Security Officer, Certification Agent, or Certification and Accreditation Project Manager.

FISMA Fellows

• Speaking in July/August
• Speaking Again
• How I Spent Friday
• NIST Framework for FISMA Dates Announced
• It’s Not Just for the Feds Anymore

Just a quick public mental health announcement.

Radio Nigel is the ultimate working music for me.  It’s all the good songs of the 80’s without all the bad songs of the 80’s.  They play lots of Cure, U2, B52s, Stranglers, Talking Heads–just about anything you could call punk, different, new wave, alt, or subversive.  Nummies all around.

• 8 Bit Peoples
• Workin’ for the ‘Counters: an Analysis of my Love-Hate Relationship with the CPAs
• Backtrack 3 USB Slides
• DHS is Looking for a CISO
• Subversive Music

I can’t believe there is such a market for technical policy compliance tools–I guess they’re all “Risk Management Tools” this year.  Save your money, you can get what you need for free.  It’s all at DISA IASE

Roughly a year ago, I wrote this post to the Security Focus penetration-testing listserv:

The SRR scripts are very good, but keep in mind that what they do is
check the configurations that are specified in the STIGs.

It goes like this:
NSA creates Security Guides
Which begat:
DISA Security Technical Implementation Guides
Which begat:
DISA Manual Checklists
Which begat:
DISA SRR Scripts

What the SRR Scripts are is an automated way to do the checks in the
manual checklists.

A word of caution is that if an OS is configured according to the STIGS,
they will break. The good thing is that it’s a fast tool to check for
vulnerabilities.

The scripts for windows machines use winbatch as the script language.
They take about 15-20 minutes to run once you’ve figured out how to do
it. What we do is go into an office, select a random percentage of
computers to check, load the script, and start it. By the time we’re
done starting the script on the last computer, it’s time to start
retrieving results off the first ones.

When DISA sends their audit team around, they run the SRR Scripts and an
external scan with ISS or Retina.

As for the .mil restriction, last time I looked at them, they allow
anybody to download the STIGS but you need a .mil address to download
the SRR Scripts. There is also the “gold disk” which has all the SRR
Scripts on it.

HTH
–Mike

Anyway, I’ve gotten a ton of mileage out of this fairly simple posting.  Here it is over a year later, and I have people that I work with telling me that they did an Internet search for DISA SRR Scripts and came up with this email, so since I’m a “qualified expert” would I give them a demonstration?

Now the beauty of the technical guidance from DISA is that they have some really good information and tools that you can use in your security program.  Managing my own commercial infrastructure, when somebody asks me what hardening guidance to use, my standard response is “How hard is it to spell DISA STIGs?”  STIGs are probably the most stringent hardening guide you’ll find out there, and very explicit in the “click this widget to off” form that the system administrators want.

All the DISA technical guidance (one exception is the Gold Disks which have all the current vendor patches and can’t be distributed for licensing reasons) is now available to the commercial world to use.  This is good, and I jokingly refer to it as our “peace dividend”.  While some of it is DoD-specific (don’t use the DoD warning banner, and be careful about disabling “bypass traversal checking” for service accounts), it makes a very good start to “roll your own” if you have to harden your IT systems.

The way to use them is that the Security Technical Implementation Guide (STIG) is a hardening guide.  The Manual Checklists are a step-by-step guide to audit a system against the STIG.  The SRR Scripts are automated versions of the checklists.  What you do is run the SRR Script and where necessary, refer back to the STIG if you have any questions on what the tool is giving you as a finding.  There are numbers to provide you with traceability back and forth.  After you’re done STIG-ing your system, hit it over the wire with a Nessus or similar, and you’ve got a hardened building block.

The advantage to using the DISA tools is that you can sit down and in half a day create a standard server/workstation/router/$foo image that can serve as your base for all builds.  With a little bit of Group Policy Object mastery, you can propagate hardening out to a bazillion workstations.

And all it costs is your time, which you would spend anyway using somebody else’s pay-to-play tools.  That’s something neat to think about.

DISA IASE

• The Vendors are Already Jumping on the 07-11 Bandwagon
• DISA SRR Lite CD
• Some Words From a FAR
• Comments on SCAP 2008
• 20 Critical Security Controls: Control-by-Control