STIG hardened Linux images for the cloud

What a STIG is

The Defense Information Systems Agency (DISA), a combat support agency of the US Department of Defense (DoD), publishes Security Technical Implementation Guides (STIGs) on cyber.mil. A STIG is a configuration standard for one product, such as an operating system: each rule names a setting, explains why it matters, and gives a check and a fix.

STIG requirements are derived from the NIST SP 800-53 security controls through DISA Security Requirements Guides (SRGs). DoD Instruction 8500.01 directs DoD components to apply STIGs and SRGs to the systems they operate, and many civilian agencies, contractors and regulated businesses use them as a hardening baseline.

DISA releases updated STIGs on a regular schedule. Each STIG ships with SCAP content so that automated scanners can check a system against it, and the DISA STIG Viewer shows every rule with its check and fix text.

CAT I, CAT II and CAT III

Every STIG rule carries a severity category code. DISA defines them as follows:

• CAT I (High): Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.
• CAT II (Medium): Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.
• CAT III (Low): Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

A High profile applies rules of every category; Medium applies CAT II and CAT III; Low applies CAT III only. Choose the lowest profile that meets your authorization requirements, since every added rule can restrict how the system is used.