DISA STIG Status Updates

[aaron-osgood]

Currently utilizing the VMware STIG Tool Appliance for STIG checks/automation. Looking specifically towards the attestation files, right now there is only the option for pass/fail (Not a Finding/Open). Requesting that Not Applicable and Not Reviewed be an option as well.

[aaronlippold]

For those you would use an overlay. Happy to talk with you about it and the process for incorporating those

[ejaronne]

For those you would use an overlay. Happy to talk with you about it and the process for incorporating those

Aaron beat me to it. Attestation is used to address things that need manual review because the automation can't. If a valid automated test measures pass/fail, and an organization wants to over-ride those results, then they should use an overlay.
https://github.com/mitre/saf?tab=readme-ov-file#attest
"Attest to 'Not Reviewed' controls: sometimes requirements can’t be tested automatically by security tools and hence require manual review, whereby someone interviews people and/or examines a system to confirm (i.e., attest as to) whether the control requirements have been satisfied."

https://mitre.github.io/saf-training/courses/beginner/10.html#additional-examples
https://github.com/mitre/sample-rhel8-overlay
https://github.com/mitre/sample-mysql-overlay
https://github.com/mitre/aws-rds-oracle-database-19c-cis-baseline

[Amndeep7]

@aaron-osgood looks like you were able to get responses from two of our leads. If you'd like to have a more in-depth conversation, please reach out to us at saf@mitre.org and we can schedule some time!

[rlakey]

@aaronlippold @ejaronne Creating an overlay is much more overhead than just maintaining an attestation file. There are also cases where manual review is required and the outcome is N/A. This is just simply asking for the attestation file to support all valid statuses for a rule.