The United States Department of Defence (DoD) designed these standards to ensure consistent and secure configurations across all environments. DISA STIG guidelines are often used as a baseline in other sectors or segments to ensure compliance with the standards and access to the DoD networks. All organizations must meet the DISA STIG security standards before accessing and operating on DoD networks. They are defined as:
DISA: Defence Information Systems Agency (provides IT and communications support to defense and federal agencies, government, and coalition partners).
STIG: Security Technical Implementation Guides (a set of rules “created and maintained based on the cybersecurity methodology for standardizing security protocols within networks, servers, computers, and logical designs to enhance overall security. These guides, when implemented, enhance security for software, hardware, physical and logical architectures to further reduce vulnerabilities”).
Runecast Analyzer automates the process of checking VMware vSphere and NSX for compliance against DISA standards – in total, 437 checks. Findings are mapped to each specific DISA vulnerability ID. Each finding is also mapped back to the affected objects, giving you details on how to manually audit and remediate any non-compliances.
With Runecast Analyzer, you get year-round, 24/7 visibility into your audit compliance posture. It allows you to get immediate visibility into risks and non-compliances inherent in your environment, allowing you to identify gaps between where you are and a fully compliant state, and also show as soon as any objects move out of compliance. Additionally, each finding details on how to manually audit and remediate any non-compliances.
The solution runs entirely on-premises, with no data leaving your control. All analysis takes place on the Runecast Analyzer appliance. Move to a more proactive way of handling your compliance requirements!