Solving Your GPO STIG Compliance Pains
You know them. You trust them. But they can add frustrating layers of complexity when it comes to STIG compliance.
Windows’ Group Policy Objects (GPOs) are an indispensable way to define what your system looks like and how it will behave for a defined group of endpoints or users. A few months ago, SteelCloud introduced ConfigOS Master Policy Object (MPO), a STIG and CIS compliance automation solution designed with GPOs, Active Directory, hybrid workforces and set-it-and-forget-it continuous compliance in mind. It addresses many of the pain points administrators have getting—and staying—compliant in the Windows environment.
We recently sat down with one of our DoD clients to hear their challenges and questions around GPOs and STIG compliance. ConfigOS MPO is the first compliance automation solution to address their pain points and put STIG and CIS compliance on auto pilot once and for all.
GPO Pain Point #1: We have so many GPOs and we’re not sure which “winning” GPO is applying which STIG setting. How can we get this situation under control?
MPO takes your existing configurations and creates a single compliance baseline. This shifts the workload from wrestling with multiple GPOs to applying STIG configurations to achieve that single baseline. ConfigOS MPO automates that process, streamlining compliance with rapid scanning and remediation, repeatable processes and continuous monitoring. In that way, all your GPOs are “winning” with MPO.
GPO Pain Point #2: GPO does not natively provide a way to document any of the deviations we have set. So we have to utilize other tools and methods for documenting these deviations. How can we better document our deviations while also consolidating our efforts around documentation?
MPO lets you set custom configurations as part of your operational policy, while simultaneously giving you the means to document those deviations (such as a waiver or even organizational notes for why a configuration was set a particular way). MPO also gives users the ability to templatize answers to documentation controls so that users are not constantly answering the same questions for every similar piece of your infrastructure or having to look back at previous checklists for answers. It is all built into the baseline/operational policy that you define. And MPO’s documentation and reporting capabilities provide a reliable and accurate record every step of the way.
GPO Pain Point #3: We have had issues in the past where we push out a setting via GPO and it causes issues with parts of our network, how can we better mitigate these situations?
It’s no mystery that STIGs break things. It is a familiar complaint in the DoD compliance world. Even with all the proper testing and validation, STIGs can still cause issues in production. Once users operationalize their compliance policy with a tool like ConfigOS MPO, however, they will have the ability to roll back any of the remediations that were previously performed. For example, if you run into a situation in your production environment where a STIG setting is the likely cause of issues happening in the network, you can quickly run a rollback to revert to any recently applied STIG settings. There is always a stable, compliant baseline to return to.
GPO Pain Point #4: We have a hybrid workforce that is not always connected to our network. Since GPO settings are only applied while connected to our corporate network, how can we ensure STIG settings are enforced at all times?
This situation is one of the driving forces behind MPO. The most effective, efficient way to address compliance for a hybrid or remote workforce is by using an agent-based architecture. By having a locally running agent on each workstation, users can send operational or baseline policy down to the ConfigOS MPO Shield which will then apply the organization’s configurations to the workstation. The Shield keeps working in the background, even when machines are disconnected from the corporate network, to ensure that the policy pushed to the workstation is constantly being applied and keeping workstations continuously in compliance.
Enjoy a relatively pain-free compliance journey with MPO.
Once implemented, MPO can scan and remediate your entire system in 2 minutes. That is not a typo. What takes you weeks and months to do manually, SteelCloud’s ConfigOS MPO can do in 2 minutes. It can also keep you continuously compliant at all times—hands-free.
Watch this video to see how MPO works, then arrange for a demo to witness our two minutes at work. Once you see how easy set-it-and-forget-it compliance can be, you’ll wonder why you waited so long!
