October 2012 DISA updates

It's been a while since I last posted....I've had a lot of irons in the fire lately.  And, it doesn't help that we have gotten really busy, or were.  Now, there are artifacts and documentation to create.

So, in doing some research for a particular client, I surfed over to DISA's site and found that they had released a whole bunch of STIGs for the quarter.  Here's the list that I found for October:

Network Infrastructure Router L3 Switch - Version 8, Release 12 - Updated October 26, 2012
Network Perimeter Router L3 Switch - Version 8, Release 12 - Updated October 26, 2012
Network L2 Switch STIG Version 8 Release 12 - Updated October 26, 2012
Network Policy - Version 8, Release 12 - Updated October 26, 2012
Network Other Devices - Version 8, Release 12 - Updated October 26, 2012
IPSEC VPN Gateway STIG, Version 1, Release 3 - Updated October 26, 2012
Network Firewall - Version 8, Release 12 - Updated October 26, 2012
Network IDS/IPS - Version 8, Release 12 - Updated October 26, 2012
Oracle 9 Database STIG, Version 8 Release 1.8 - Updated October 26, 2012
Oracle 10 Database STIG, Version 8 Release 1.9 - Updated October 26, 2012
Oracle 11 Database STIG, Version 8 Release 1.9 - Updated October 26, 2012
McAfee Antivirus Security Guidance - Version 4, Release 7 - Updated October 26, 2012
General Desktop Application STIG Version 4, Release 3 - Updated October 26, 2012
Microsoft Office 2010 STIG Version 1, Release 5 - Updated October 26, 2012
Microsoft Office 2007 STIG - Version 4, Release 9 - Updated October 26, 2012
Microsoft SharePoint 2010 STIG Version 1, Release 2 - Updated October 26, 2012
BlackBerry STIG - Version 2, Release 2 - Updated October 26, 2012
DoD Host Based Security System (HBSS) STIG - Version 4, Release 3 - Updated October 26, 2012
SPAN Keyboard Video Switch (KVM) STIG, Version 2, Release 2 - Updated October 26, 2012
SPAN Multi-Function Device (MFD) and Printer STIG, Version 2, Release 2 - Updated October 26, 2012
SPAN Storage Area Network (SAN) STIG - Version 2, Release 2 - Updated October 26, 2012
REL LAN STIG - Version 1, Release 3 - Updated October 26, 2012
Internet Explorer 6 STIG - Version 4, Release 7 - Updated October 26, 2012
Internet Explorer 7 STIG - Version 4, Release 8 - Updated October 26, 2012
Internet Explorer 8 STIG - Version 1, Release 8 - Updated October 26, 2012
Internet Explorer 8 STIG Benchmark - Version 1, Release 8 - Updated October 26, 2012
Internet Explorer 9 STIG Version 1, Release 3 - Updated October 26, 2012
Mozilla Firefox STIG - Version 4, Release 5 - Updated October 26, 2012
z/OS ACF2 STIG - Version 6, Release 13 - Updated October 26, 2012
z/OS RACF STIG - Version 6, Release 13 - Updated October 26, 2012
z/OS TSS STIG - Version 6, Release 13 - Updated October 26, 2012
zOS SRR Scripts Version 6, Release 13 - Updated October 26, 2012
Windows Vista STIG, Version 6, Release 1.27 - Updated October 26, 2012
Windows Vista STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows XP STIG, Version 6, Release 1.27 - Updated October 26, 2012
Windows XP STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 STIG - Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 DC STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 MS STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2008 STIG - Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 DC STIG Benchmark Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 MS STIG Benchmark Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 R2 STIG - Version 1, Release 6 - Updated October 26, 2012
Windows 2008 R2 DC STIG Benchmark Version 1, Release 6 - Updated October 26, 2012
Windows 2008 R2 MS STIG Benchmark Version 1, Release 6 - Updated October 26, 2012
Windows 7 STIG - Version 1, Release 10 - Updated October 26, 2012
Windows 7 STIG Benchmark Version 1, Release 14 - Updated October 26, 2012
Gold Disk (*PKI) - Updated October 26, 2012
IAVM to CVE Mapping Spreadsheet - Updated October 26, 2012
Draft Internet Explorer 10 STIG Version 1 - Updated October 24, 2012
2012 STIG TIM and DSAWG Schedule - Updated October 24, 2012
Draft Mobile Policy SRG, Version 1, Release 0.2 - October 19, 2012
STIG Viewer - Version 1.1.2 - October 19, 2012
IAVM 2012 - Benchmark (HBSS Only) (*PKI) - Updated October 15, 2012
Draft Traditional Security STIG - Updated October 15, 2012
Draft Application Server SRG, Version 1, Release 0.2 - Updated October 11, 2012
Mobile OS SRG, Version 1, Release 1 - Updated October 10, 2012

The STIGs with (*PKI) after the name need special credentials.

I noticed that Gold Disk was updated.  I thought I read that this is the last update for Gold Disk.  I have not used it in quite a while, as we have been transitioning to the SCAP Compliance Checker (SCC) for all of our SCAP content.  I do miss the MS Office checks and browser checks that were bundled in Gold Disk.  But, we're finding that scripting out SCC has been meeting our needs.

New Google Chrome STIG, out in draft

While browsing DISA's STIG section today, I noticed an announcement for a new STIG for Google Chrome.  Note that the STIG is in draft.

You can get the STIG here.

Striking out on your own

I'm getting that itch to go back to working for myself exclusively.  Partly, I think it is because I'm passionate about the work I do on my own, and not so much the DoD contracting work.  Of course, the big fear is not making enough money.  And benefits.  And the marketing.

A while back, Hal Pomeranz put out a great series of articles about his experiences going it alone.  I'm linking them here as they have helped me, and others can get some benefit from them.

Enjoy.  And I hope they help you as much as they have helped me.

Part 1 - The Case for Consulting
Part 2 - An Important Cash-Flow Lesson
Part 3 - Billing Rates
Part 4 - Insurance Matters
Part 5 - Finding Work
Part 6 - Work Finds Experts
Part 7 - Work?  What Work?
Part 8 - Avoiding Overhead
Part 9 - Knowing When To Say When

A small business opinion

SANS had a great post the other day on protecting small- and medium-sized businesses.  As I have a small company that responds to many small-business incidents I tend to see first hand the whats and the whys.  Most of my work with my own company comes from a business that has been hacked or that gets some kind of malware infection.  And time and time again, when we go in to look at what happened, we see that there are no controls or very little controls in place.  And, nine times out of ten, the clients have no visibility to even see if there WERE things that might be amiss.  It's only when the pop-ups start, the browsers are hijacked, or the machine crawls that anyone decides to do anything.

So, we end up remediating.  Then we propose actions to take to prevent the issue from occurring again in the future.  Inevitably, I think it comes down to money.  The economy is tough.  Times are tough.  Businesses are scrapping just to stay afloat.  And, as such, whatever is not 100% necessary, or does not SHOW massive improvements to the bottom line gets dropped in favor of something that will help the company stay profitable.  I believe the mindset is that many times it is cheaper to slap band aids on the problem each time that there is an incident rather than fix the deep rooted issues in an attempt to stay safer in the long term.

Just what I've seen.

DISA Updates

It has been a while since I last posted....there has been a lot of travel and work of late.  However, while perusing DISA's STIG page, I came across the quarterly updates.

The following STIGs have been updated since I last wrote.  Note that STIGs and tools with (*PKI) will require authentication.

IAVM to CVE Mapping Spreadsheet - Updated August 3, 2012
STIG Viewer Beta - Version 1.1.0 - New August 1, 2012
DoD Host Based Security System (HBSS) STIG - Version 4, Release 2 - Updated July 27, 2012
Enclave Zone A Checklist - Version 4, Release 5 - Updated July 27, 2012
Enclave Zone B Checklist - Version 4, Release 5 - Updated July 27, 2012
Enclave Zone C Checklist - Version 4, Release 5 - Updated July 27, 2012
Enclave Zone D Checklist - Version 4, Release 5 - Updated July 27, 2012
Enclave Security Checklist - Version 4, Release 5 (*PKI) - Updated July 27, 2012
Network Firewall - Version 8, Release 11 - Updated July 27, 2012
Network IDS/IPS - Version 8, Release 11 - Updated July 27, 2012
IPSEC VPN Gateway STIG, Version 1, Release 2 - Updated July 27, 2012
Network Other Devices - Version 8, Release 11 - Updated July 27, 2012
Network Policy - Version 8, Release 11 - Updated July 27, 2012
Network Infrastructure Router L3 Switch - Version 8, Release 11 - Updated July 27, 2012
Network Perimeter Router L3 Switch - Version 8, Release 11 - Updated July 27, 2012
Network L2 Switch STIG Version 8 Release 11 - Updated July 27, 2012
RAS Remote Access Server STIG Version 2, Release 7 - Updated July 27, 2012
Remote Access Policy STIG Version 2, Release 7 - Updated July 27, 2012
Remote Access VPN STIG Version 2, Release 7 - Updated July 27, 2012
Remote Endpoint STIG Version 2, Release 7 - Updated July 27, 2012
Remote XenApp ICA Thin Client STIG Version 2, Release 7 - Updated July 27, 2012
z/OS ACF2 STIG - Version 6, Release 12 - Updated July 27, 2012
z/OS RACF STIG - Version 6, Release 12 - Updated July 27, 2012
z/OS TSS STIG - Version 6, Release 12 - Updated July 27, 2012
zOS SRR Scripts Version 6, Release 12 (*PKI) - Updated July 27, 2012
Windows 2003 STIG - Version 6, Release 1.26 - Updated July 27, 2012
Windows 2003 DC STIG Benchmark Version 6, Release 1.25 - Updated July 27, 2012
Windows 2003 MS STIG Benchmark Version 6, Release 1.26 - Updated July 27, 2012
Windows 2008 STIG - Version 6, Release 1.19 - Updated July 27, 2012
Windows 2008 DC STIG Benchmark Version 6, Release 1.19 - Updated July 27, 2012
Windows 2008 MS STIG Benchmark Version 6, Release 1.18 - Updated July 27, 2012
Windows 2008 R2 STIG - Version 1, Release 5 - Updated July 27, 2012
Windows 2008 R2 DC STIG Benchmark Version 1, Release 5 - Updated July 27, 2012
Windows 2008 R2 MS STIG Benchmark Version 1, Release 5 - Updated July 27, 2012
Windows 7 STIG - Version 1, Release 9 - Updated July 27, 2012
Windows 7 STIG Benchmark Version 1, Release 13 - Updated July 27, 2012
Windows Vista STIG, Version 6, Release 1.26 - Updated July 27, 2012
Windows Vista STIG Benchmark Version 6, Release 1.26 - Updated July 27, 2012
Windows XP STIG, Version 6, Release 1.26 - Updated July 27, 2012
Windows XP STIG Benchmark Version 6, Release 1.26 - Updated July 27, 2012
IAVM 2012 - Benchmark (HBSS Only) (*PKI) - Updated July 27, 2012
McAfee Antivirus Security Guidance - Version 4, Release 6 - Updated July 27, 2012
Internet Explorer 6 STIG - Version 4, Release 7 - Updated July 27, 2012
Internet Explorer 7 STIG - Version 4, Release 7 - Updated July 27, 2012
Internet Explorer 8 STIG - Version 1, Release 7 - Updated July 27, 2012
Internet Explorer 8 STIG Benchmark - Version 1, Release 6 - Updated July 27, 2012
Internet Explorer 9 STIG Version 1, Release 2 - Updated July 27, 2012
Internet Explorer 9 STIG Benchmark - Version 1, Release 2 - Updated July 27, 2012
Microsoft Office 2010 STIG Version 1, Release 4 - Updated July 27, 2012
Microsoft Office 2007 STIG - Version 4, Release 8 - Updated July 27, 2012
Gold Disk (*PKI) - Updated July 27, 2012
IAVM 2012 Benchmarks - Updated July 24, 2012
Draft Intrusion Detection and Prevention System SRG, Version 1, Release 0.3 - Updated July 17, 2012
Windows 7 STIG Benchmark Version 1, Release 12 - Updated July 13, 2012
Database Security Requirements Guide (SRG) - Version 1, Release 1 - Updated July 13, 2012

I made one edit to the list.  The list seems to indicate that the Enclave Zone A checklist was updated four times.  I looked, and found that Zone A, Zone B, Zone C, AND Zone D were updated.  I think it is just a typo in their list of checklists on the main STIG page.  Also note that Gold Disk has been updated. While we use the Gold Disk in limited situations, as auditors, we've been pushing the use of the SCAP Compliance Checker.  So far, we have not had problems; either scripting it out to many machines or in the returning of results.  We have, though, spent some time weeding out false positives.

DFIR Summit presentations and reviews

Alas, another year goes by, and I was not able to make it to the SANS DFIR Summit.  I've mentioned it in the past.  And this year, like previous, the company would not spring for it.  So, I have to live vicariously through the write-ups of those that got to attend and present.

I was real glad to see that SANS is hosting archives of the Summit, which you can find here.

And, I saw a whole bunch of write-ups of the event in my feed reader today.  I've listed them below.  As I see/read other write-ups, I'll add them to this list.

Harlan's write-up is found here.

Melia's write-up is here.

Frank's write-up is here.

Ken's write-up is here.

As I've said every year....I hope circumstances allow me to attend next year.  For now, I'll be pouring through the summit archives.

Girl, Unallocated's Forensic Report Writing Cheat Sheet

I know I haven't posted for a while, it's been slow going, on all fronts.  This post is mostly a mental note for myself, as I am sure I will need to reference it in the future.  A few weeks ago, Girl, Unallocated put up a great post on her methodology for creating a Forensic Report, post analysis.  The cool part is that in looking at the flowchart, there appears to be sections that can be built now, and filled in with details when the analysis is performed.  If I'm smart, I'll get to work on this now, and save myself the work later on.

I don't mind the writing aspect of the work.  Forensic reports or DIACAP packages, it doesn't matter to me.  The data and results has to be communicated to someone, and some type of report is necessary.  I suspect that that sentiment is true to almost all segments of the IT field.  But, good (report) writing helps us in our fields to better communicate what we find; and in turn, it helps others make decisions and/or judgements that lead to next steps.

I urge other forensicators to read her post, linked to here.

To Screenlock or Not a mobile phone

Being a security guy, I keep security in the back of mind.  Quite often, I put that knowledge to use when I least expect it.  I've had a cell phone for quite a while, many years in fact.  I've never used anything like a screen lock; be it a password or a pattern lock.  And I've got two different ways of thinking.

1.  In order to be secure, I know that I should lock my phone.  That way, should I ever lose the phone, misplace it, or, the phone gets stolen, I'll have "some" barrier (however strong) to prevent the casual person from snooping on the contents.  I know that it won't stop a determined attacker, but it should stop the low-hanging fruit masses.  I've seen different locks, both password-type locks and pattern locks.  Either one would be fine by me.

2.  The other side of my brain says "Hey, what happens if you are in an accident and EMS needs your phone?"  Does EMS do that?  Meaning, do they go to victims phones to contact someone, or for identity?  Are they allowed to.  I remember seeing the "news articles" back when cell phones were getting more popular that you should have an "ICE Contact" (that's In Case of Emergency.)

So, what's a good choice?  What balances out security with peace of mind?  Am I mis-informed about what EMS can and can not do?

What's your opinion...

DISA STIG updates since I last wrote

I know it has been a while since I last wrote.  And since that time, DISA has updated many of their STIGs and benchmarks.  I've included the list below.  Be aware that any item with a "*" is located in the PKI-protected area.

Here's the list:

Internet Explorer 9 STIG Version 1, Release 1 - Updated May 21, 2012
Internet Explorer 9 STIG Release Memo - Updated May 21, 2012
Traditional Basic Checklist (*PKI) - Updated May 21, 2012
Traditional Common Compliance Validation Checklist (*PKI) - Updated May 21, 2012
Traditional NIPRNet Compliance Validation Checklist (*PKI) - Updated May 21, 2012
Traditional SIPRNet Compliance Validation Checklist (*PKI) - Updated May 21, 2012
IPSEC VPN Gateway STIG, Version 1, Release 1 - Updated May 21, 2012
IPSEC VPN Gateway STIG Memo - Updated May 21, 2012
IAVM to CVE Mapping Spreadsheet - Updated May 18, 2012
Policy Auditor / STIG Viewer Operational Guidance - Updated May 14, 2012
SCAP Implementation Process Guidance - Updated May 14, 2012
SCC 3.0.1 Read Me - Updated May 14, 2012
IAVM 2012 Benchmarks - Updated May 7, 2012
SCC 3.0.1 SCC DEBIAN i386 - Updated May 2, 2012
SCC 3.0.1 DEBIAN AMD64 - Updated May 2, 2012
STIG Library Compilation Bulk Download (.zip format) - Updated May 2, 2012
Windows 7 STIG, Version 1, Release 8 (*PKI) - Updated April 27, 2012
Windows 7 STIG - Version 1, Release 8 - Updated April 27, 2012
Windows 7 STIG Benchmark Version 1, Release 10 - Updated April 27, 2012
Windows 2003 STIG - Version 6, Release 1.25 - Updated April 27, 2012
Windows 2003 STIG, Version 6, Release 1.25 (*PKI) - Updated April 27, 2012
Windows 2003 DC STIG Benchmark Version 6, Release 1.25 - Updated April 27, 2012
Windows 2003 MS STIG Benchmark Version 6, Release 1.25 - Updated April 27, 2012
Windows 2008 STIG - Version 6, Release 1.18 - Updated April 27, 2012
Windows 2008 STIG - Version 6, Release 1.18 (*PKI) - Updated April 27, 2012
Windows 2008 DC STIG Benchmark Version 6, Release 1.18 - Updated April 27, 2012
Windows 2008 MS STIG Benchmark Version 6, Release 1.18 - Updated April 27, 2012
Windows 2008 R2 STIG - Version 1, Release 4 - Updated April 27, 2012
Windows 2008 R2 STIG - Version 1, Release 4 (*PKI) - Updated April 27, 2012
Windows 2008 R2 DC STIG Benchmark Version 1, Release 4 - Updated April 27, 2012
Windows 2008 R2 MS STIG Benchmark Version 1, Release 4 - Updated April 27, 2012
Windows Vista STIG, Version 6, Release 1.25 - Updated April 27, 2012
Windows Vista STIG, Version 6 Release 1.25 (*PKI) - Updated April 27, 2012
Windows Vista STIG Benchmark Version 6, Release 1.25 - Updated April 27, 2012
Windows XP STIG, Version 6, Release 1.25 - Updated April 27, 2012
Windows XP STIG, Version 6 Release 1.25 (*PKI) - Updated April 27, 2012
Windows XP STIG Benchmark Version 6, Release 1.25 - Updated April 27, 2012
z/OS ACF2 STIG - Version 6, Release 11 - Updated April 27, 2012
z/OS ACF2 STIG - Version 6, Release 11 (*PKI) - Updated April 27, 2012
z/OS RACF STIG - Version 6, Release 11 - Updated April 27, 2012
z/OS RACF STIG - Version 6, Release 11 (*PKI) - Updated April 27, 2012
z/OS TSS STIG - Version 6, Release 11 - Updated April 27, 2012
z/OS TSS STIG - Version 6, Release 11 (*PKI) - Updated April 27, 2012
zOS SRR Scripts Version 6, Release 11 (*PKI) - Updated April 27, 2012
Network Firewall - Version 8, Release 10 - Updated April 27, 2012
Network IDS/IPS - Version 8, Release 10 - Updated April 27, 2012
Network Other Devices - Version 8, Release 10 - Updated April 27, 2012
Network Policy - Version 8, Release 10 - Updated April 27, 2012
Network Infrastructure Router L3 Switch - Version 8, Release 10 - Updated April 27, 2012
Network Perimeter Router L3 Switch - Version 8, Release 10 - Updated April 27, 2012
Network L2 Switch STIG Version 8 Release 10 - Updated April 27, 2012
Internet Explorer 6 STIG - Version 4, Release 6 - Updated April 27, 2012
Internet Explorer 7 STIG - Version 4, Release 6 - Updated April 27, 2012
Internet Explorer 8 STIG - Version 1, Release 6 - Updated April 27, 2012
Internet Explorer 8 STIG Benchmark - Version 1, Release 6 - Updated April 27, 2012
Mozilla Firefox STIG - Version 4, Release 4 - Updated April 27, 2012
Microsoft Office 2010 STIG Version 1, Release 3 - Updated April 27, 2012
Microsoft Office 2007 STIG - Version 4, Release 7 - Updated April 27, 2012
Microsoft Office 2003 STIG - Version 4, Release 3 - Updated April 27, 2012
McAfee Antivirus Security Guidance - Version 4, Release 5 - Updated April 27, 2012
General Desktop Application STIG, Version 1, Release 2 - Updated April 27, 2012
General Mobile Device (Non-Enterprise Activated) STIG Version 1, Release 2 - Updated April 27, 2012
DoD Host Based Security System (HBSS) STIG - Version 3, Release 6 (*PKI) - Updated April 24, 2012
Gold Disk (*PKI) - Updated April 23, 2012
SCAP Tools (SCC 3.0.1) - Updated April 17, 2012

Guides for locking down Twitter, Google+, Facebook and LinkedIn

Chief Monkey put up a post the other day on locking down some of the big Social Media websites.  As the security policies change it can be harder and harder to keep track of what the actual settings are.  Read the post, it's good stuff.  Here are the direct links to the guides:

Twitter

LinkedIn

Google +

Facebook

As the Chief mentions, it will help friends and family lock down their accounts keeping people (and their information) safer.