Aug 07, 2017 The Navy Testing Guidance says, 'The NQV must import XCCDF results of an SCC scan into the STIG Viewer for integration with the complete STIG.' So I don't think there's a lot of value in importing any SCAP STIG results directly into Vulnerator. Customize and filter your results with our built-in-tools, or complete your STIG Viewer checklist with our automated checklist integration. DoD ConfigOS has been widely implemented throughout the Department of Defense in classified and unclassified environments, tactical programs, weapon systems, disconnected labs, and cloud applications. Learning Curve - download a viewer, download the current STIGs, read the STIGs, set up to accommodate quick iterations and practice 2. DISA/STIGs content and tools –import and export files so you can manipulate the data, archive and retrieve results effectively 3. Project documentation –is there an organizationally-prescribed format,.

STIG Viewing Tools

XCCDF formatted SRGs and STIGs are intended be ingested into an SCAP validated tool for use in validating compliance of a Target of Evaluation (TOE). As such, getting to the content of a XCCDF formatted STIG to read and understand the content is not as easy as opening a .doc or .pdf file and reading it. The process can be a little confusing and trying. Below are tools which can be used to view the STIGs and a Whitepaper describing the STIG Viewing processes.

Stig Viewer For Linux

DISA has produced standalone versions of STIG Viewer for the Windows, Linux, and macOS platforms on 64-bit x86 processors. With the end of free support for Java 8 in early 2019, Oracle Corporation changed the licensing and distribution model for Java software. Users without supported Java 8 SE environments should use the standalone versions of STIG Viewer. Users with supported Java 8 SE environments may still use the current JAR file. DISA will base future STIG Viewer development on open-source software developed by the OpenJDK and OpenJFX projects.

Title	Size	Updated
STIG Viewer User Guide (May 2021)	1.86 MB	22 Apr 2021
STIG Viewer 2.14 Hashes	1.36 KB	22 Apr 2021
STIG Viewer 2.14-Mac	62.15 MB	22 Apr 2021
STIG Viewer 2.14-Linux	71.57 MB	22 Apr 2021
STIG Viewer 2.14-Win64	61.03 MB	22 Apr 2021
STIG Viewer 2.14	712.99 KB	22 Apr 2021
How to Create and SRG-STIG ID Mapping Spreadsheet	298.21 KB	03 Feb 2021
STIG Viewer Version 2.11 Change Log	67.5 KB	10 Aug 2020
Vendor STIG Acronym List	178.74 KB	16 Jan 2020
HOW_TO_VIEW_SRGs_and_STIGs	79.49 KB	30 Nov 2018
STIG Viewer Video	—	14 Jun 2018
STIG Sorted by STIG ID	103.46 KB	30 Mar 2015
STIG Sorted by Vulnerability ID	101.59 KB	30 Mar 2015

SRG/STIG Applicability Guide and Collection Tool

The purpose of the SRG/STIG Applicability Guide and Collection Tool is to assist the SRG/STIG user community in determining what SRGs and/or STIGs apply to a particular situation or Information System (IS) and to create a fully formatted document containing a “Collection” of SRGs and STIGs applicable to the situation being addressed.

Stig Viewer A-z

Stig Viewer Iis

The ISs or situations covered include a Base/Camp/Post/or Station (B/C/P/S), facility, Program /Service/major application, enclave, network, system, device, or vendor’s product.

The Collection document can serve as an artifact in the System Authorization and Risk Management processes.

The SRG/STIG Applicability Guide and Collection Tool will be updated periodically to include the most recent new SRG/STIG releases and sunset products.

What Is Stig Viewer

For assistance, please contact disa.stig_spt@mail.mil

Title	Size	Updated
SRG-STIG Applicability Guide - User Guide v1.5	2.64 MB	12 May 2021
STIG Applicability Guide-Linux	38.61 MB	12 May 2021
STIG Applicability Guide-Mac	33.81 MB	12 May 2021
STIG Applicability Guide-Windows	36.89 MB	12 May 2021

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
V-242388	High	The Kubernetes API server must have the insecure bind address not set.	By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the 'insecure bind' address and is set by default to localhost. ...
V-242381	High	The Kubernetes Controller Manager must create unique service accounts for each work payload.	The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the API Server. Every process executed in a pod has an associated ...
V-242383	High	User-managed resources must be created in dedicated namespaces.	Creating namespaces for user-managed resources is important when implementing Role-Based Access Controls (RBAC). RBAC allows for the authorization of users and helps support proper API server ...
V-242386	High	The Kubernetes API server must have the insecure port flag disabled.	By default, the API server will listen on two ports. One port is the secure port and the other port is called the 'localhost port'. This port is also called the 'insecure port', port 8080. Any ...
V-242387	High	The Kubernetes Kubelet must have the read-only port flag disabled.	Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no authentication or authorization security control. Providing unrestricted access on ...
V-242392	High	The Kubernetes kubelet must enable explicit authorization.	Kubelet is the primary agent on each node. The API server communicates with each kubelet to perform tasks such as starting/stopping pods. By default, kubelets allow all authenticated requests, ...
V-242391	High	The Kubernetes Kubelet must have anonymous authentication disabled.	A user who has access to the Kubelet essentially has root access to the nodes contained within the Kubernetes Control Plane. To control access, users must be authenticated and authorized. By ...
V-242390	High	The Kubernetes API server must have anonymous authentication disabled.	The Kubernetes API Server controls Kubernetes via an API interface. A user who has access to the API essentially has root access to the entire Kubernetes cluster. To control access, users must be ...
V-242397	High	The Kubernetes kubelet static PodPath must not enable static pods.	Allowing kubelet to set a staticPodPath gives containers with root access permissions to traverse the hosting filesystem. The danger comes when the container can create a manifest file within the ...
V-242415	High	Secrets in Kubernetes must not be stored as environment variables.	Secrets, such as passwords, keys, tokens, and certificates should not b