1st question – 1 page:
Please review the following resources before beginning this assignment:
DISA STIG Repository
Using the DoD STIG and SCAP Tool Basic Rundown
For this assignment, we are going to run the DISA STIG against our own operating system. You do not necessarily have to make the changes if you do not desire to. But you must notate the answers to the checks.
If the operating system on your computer is Windows 10, please download the latest Windows 10 STIG. If you use macOS, download the latest macOS STIG, and for Linux, download the closest Linux STIG (if you use Ubuntu, use the ubuntu STIG, etc…).
You must also download the latest STIG viewer available as well.
It is recommended that you download the latest SCAP Compliance Checker (SCC) as well, and the applicable SCAP 1.2 or 1.3 content for your operating system (if one exists).
For this lab, you will conduct the following:
Using the SCAP Content Checker, run a scan with only the operating system benchmark chosen (if one exists). This will export an XCCDF file.
Open DISA STIG Viewer and then create a Checklist using the zip file for your operating system that you downloaded.
If you were able to run SCC on your device, import the XCCDF into the STIG Viewer and you’ll see a large variety of STIGs are already completed.
For any Not Reviewed checks, complete them.
For any Open checks, provide an explanation in the comments on what this finding means for your security.
For any Not a Finding checks, nothing is needed.
At the end of this, if SCC was not used, you must have at least 50 items that are in the status of either Open, Not a Finding, or Not Reviewed.
If SCC was used, there should be no Not Reviewed checks. All checks should be Open, Not a Finding, or Not Applicable.
If there are not 50 items, this assignment will be marked as Not complete.
For the submission, you must save the checklist file as a .ckl file and submit the ckl file itself.Please review the following resources before beginning this assignment:
DISA STIG Repository
Using the DoD STIG and SCAP Tool Basic Rundown
For this assignment, we are going to run the DISA STIG against our own operating system. You do not necessarily have to make the changes if you do not desire to. But you must notate the answers to the checks.
If the operating system on your computer is Windows 10, please download the latest Windows 10 STIG. If you use macOS, download the latest macOS STIG, and for Linux, download the closest Linux STIG (if you use Ubuntu, use the ubuntu STIG, etc…).
You must also download the latest STIG viewer available as well.
It is recommended that you download the latest SCAP Compliance Checker (SCC) as well, and the applicable SCAP 1.2 or 1.3 content for your operating system (if one exists).
For this lab, you will conduct the following:
Using the SCAP Content Checker, run a scan with only the operating system benchmark chosen (if one exists). This will export an XCCDF file.
Open DISA STIG Viewer and then create a Checklist using the zip file for your operating system that you downloaded.
If you were able to run SCC on your device, import the XCCDF into the STIG Viewer and you’ll see a large variety of STIGs are already completed.
For any Not Reviewed checks, complete them.
For any Open checks, provide an explanation in the comments on what this finding means for your security.
For any Not a Finding checks, nothing is needed.
At the end of this, if SCC was not used, you must have at least 50 items that are in the status of either Open, Not a Finding, or Not Reviewed.
If SCC was used, there should be no Not Reviewed checks. All checks should be Open, Not a Finding, or Not Applicable.
If there are not 50 items, this assignment will be marked as Not complete.
For the submission, you must save the checklist file as a .ckl file and submit the ckl file itself.
https://public.cyber.mil/stigs/downloads/https://public.cyber.mil/stigs/downloads/
https://www.youtube.com/watch?v=dtHmpqevumQhttps://www.youtube.com/watch?v=dtHmpqevumQ
https://public.cyber.mil/stigs/srg-stig-tools/https://public.cyber.mil/stigs/srg-stig-tools/
https://public.cyber.mil/stigs/scap/https://public.cyber.mil/stigs/scap/
________________________________________________
Another question – 2 pages
For this assignment, submit a document that discusses what you have completed towards your OS Improvement Plan up to this point. This should be a high-level overview that explains what controls you have developed a recommendation for so far, and how many. You are not expected to have 100% completion of all CIS 18 controls at this time. 50% of controls in IG1 is a good mark to hit at this point.
Your submission must include the following:
A summary of all identified deficiencies according to the CIS 18 IG1.
A high-level overview of controls answered. For example:
Control 1: 50%
Control 2: 66%
Control 3: 32%
And so on
Please provide recommendations which controls helps or assists Raven Corp with getting to a better security posture and maturity level. You must download the control spreadsheet and change/recommend changes in spreadsheet to see how controls and implementing policy impact the overall dashboard. This will be an iterative process.
If you want, you can and your professor can provide initial guidance on the recommendations that you have at this point.
_______________
Question 3 – 3 slides
Privileged Account Management (PAM) is an essential topic in OS security. If an attacker gains access to your privileged accounts, then it is game over. They will have unrestricted access to your OS in almost every scenario. This is why properly managing your privileged accounts is so important.
The CISO has come to you again to help plan their PAM solutions. Throughout this PowerPoint, make sure you are targeting Raven Corporation’s infrastructure.
For this PowerPoint, please discuss the following topics:
What is Privileged Account Management? Why is it important?
What kinds of accounts can be considered privileged on a Windows box? What about on a Linux box?
Identify three different enterprise tools for PAM. Identify how they differ from each other. In your opinion, which one is the best of these three options?
How do managing local privileged accounts differ from managing the privileged accounts that are found in Active Directory?
PowerPoint Requirements
Minimum Slides: No minimum. Do what you think is right.
Must use proper grammar/spelling/APA formatting.
No crazy templates
You must record yourself presenting the presentation. It does not need to include a video of yourself, but it does need to include an audio recording.
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|