05. Auditing using SCAP & STIG Viewer

Overview¶

This lab demonstrates how to perform system security auditing using:

SCAP (Security Content Automation Protocol)
STIG (Security Technical Implementation Guides)
SCAP Compliance Checker Tool

These tools help organizations evaluate whether a system complies with security standards.

What is SCAP?¶

SCAP (Security Content Automation Protocol) is a standardized framework used to:

Automate vulnerability scanning
Measure system compliance
Enforce security policies

Key Features¶

Uses XML-based standards
Integrates with vulnerability databases
Automates compliance checks

What is STIG?¶

STIG (Security Technical Implementation Guides) are security configuration standards developed by DISA.

Purpose¶

Define secure configurations for systems
Reduce vulnerabilities
Enforce compliance policies

Example¶

For Windows Server 2019 STIG:

Disable insecure protocols
Enforce password policies
Enable logging and auditing

What is CMMC?¶

CMMC (Cybersecurity Maturity Model Certification) measures cybersecurity maturity across organizations.

Levels¶

Level	Description
Level 1	Basic Cyber Hygiene
Level 2	Intermediate
Level 3	Good Cyber Hygiene
Level 4	Proactive
Level 5	Advanced

Tools Used¶

SCAP Compliance Checker¶

A tool used to:

Load SCAP content
Run compliance scans
Generate reports

Lab Workflow¶

Step 1: Load SCAP Content¶

Open SCAP Compliance Checker
Select scan type: Local Scan
Load SCAP content (e.g., Windows Server 2019 STIG)

Step 2: Run Scan¶

Click Start Scan
Tool collects:
- Registry data
- System configuration
- Security settings

Step 3: Analyze Output¶

The tool generates logs showing:

Passed checks
Failed checks
Errors

Example:

Processing rule: Windows Server must enforce password complexity
Result: FAIL

Step 4: View Results¶

After scan completion:

Open Results Viewer
Check summary:

Score: 46.37%
Status: RED (Non-compliant)

Understanding the Score¶

Score Range	Meaning
90–100	Fully compliant
80–89	Minor issues
< 80	Non-compliant

Example from lab:

Score: 46.37%
Interpretation: System has major security issues

Example Finding¶

Rule: PowerShell Script Block Logging¶

Requirement:
Enable PowerShell script block logging.

Status:
FAIL

Explanation¶

Logging is disabled
System cannot track malicious scripts

Fix¶

Computer Configuration →
Administrative Templates →
Windows Components →
Windows PowerShell →
Enable "Turn on PowerShell Script Block Logging"

Example Finding 2¶

Rule: Disable Reversible Password Encryption¶

Issue:
Passwords stored in reversible format

Risk:

Equivalent to storing plaintext passwords

Fix¶

Computer Configuration →
Windows Settings →
Security Settings →
Account Policies →
Password Policy →
Disable "Store passwords using reversible encryption"

Example Finding 3¶

Rule: Disable IPv6 Source Routing¶

Risk:

Attackers can manipulate packet routing (spoofing)

Fix¶

Disable IPv6 source routing via Group Policy

STIG Viewer Tool¶

Used to:

Browse STIG rules
View detailed compliance requirements
Understand severity levels

Categories¶

CAT I → High severity
CAT II → Medium
CAT III → Low

Key Concepts¶

Compliance vs Security¶

Compliance = Following rules
Security = Actually being protected

Both are important.

Advantages of SCAP + STIG¶

Automated auditing
Standardized security checks
Detailed reporting
Helps in enterprise environments

Limitations¶

Requires proper configuration
False positives possible
Needs manual validation

Real-World Use Cases¶

Government systems (DISA compliance)
Enterprise security audits
Cloud compliance validation
Penetration testing baseline checks

Conclusion¶

This lab shows how to:

Use SCAP tools for auditing
Analyze compliance reports
Identify vulnerabilities
Apply security fixes

A low score (like 46.37%) indicates serious misconfigurations that must be remediated to secure the system.