STIG 101: Addressing the Heart of Cybersecurity

There’s a reason we say #STIGLove.

They work in hidden spots, going hand-to-hand with ransomware—and winning. They partner with Zero Trust to keep hackers at bay. And they identify and fix vulnerabilities before bad actors can exploit them.

Security Technical Implementation Guides (STIGs) are the ninjas of the cybersecurity world. They not only address creating a secure baseline, but they also address ransomware threats and Zero Trust implementation, two of the hottest topics in cybersecurity today.

How do STIGs help with ransomware?

 One of the most common and effective forms of malware attack is ransomware. Bad actors enter the system through phishing or an infected server or site. Then they render your files unusable and demand a ransom to get them back. Ransomware attacks cost millions, damage your reputation, and erode trust.

Overall, STIGs support a healthy cyber regimen. And a healthy cyber regimen helps keep bad actors out and unable to attack the network. But more specifically, there are STIGs in place to address known ransomware attack vectors. For example:

• In Microsoft Office, STIGs prevent linking to other sites from within documents, as bad actors commonly embed malicious links in files.
• In operating systems, STIGs block malicious actors from entering by requiring complex logon requirements, limiting failed logon attempts, and enabling early warning of questionable activity on the network.
• With browsers, STIGs reduce the attack surface by preventing the running of mini Java applets or the download of cookies and software without authorization.

In essence, STIG compliance reduces the avenues of attack within your system. When used in tandem with traditional approaches, such as password protection, it is extremely rare to suffer a major attack with a fully STIGged system.

Are STIGs and Zero Trust compatible?

In addition to STIGs, Zero Trust is another preventative measure government organizations implement to ward off bad actors. The DoD is already transitioning to Zero Trust cybersecurity frameworks and urges all its agencies and organizations to follow suit. As you might imagine, Zero Trust means that you trust nobody who enters your system.

With Zero Trust, authentication moves from the perimeter to data-specific entryways. The five fundamental assertions of a Zero Trust network are:

• The network is always assumed to be hostile
• There are external and internal threats on the network at all times
• Network locality is not sufficient enough for deciding trust in the network
• Every device, user, and network flow is authenticated and authorized
• Policies must be dynamic and calculated from multiple sources of data

In other words, a Zero Trust approach assumes every attempt to access the system is a breach. So you only get to access the data and capabilities you need, authenticating again and again the deeper your access takes you. This contains the blast radius of malicious activity to just the part of your system that got breached. Having a secure baseline that meets STIG standards helps capture unauthorized access attempts and makes your network that much harder to attack. 

What else do I need to know about STIGs?

STIGs are at the foundation of everything from preventing ransomware attacks to implementing Zero Trust. Securing your system to those standards takes an overwhelming amount of effort if you implement manually. But DoD-aligned automation can make it an easy part of your routine.

To learn more about STIGs from the people who specialize in them, download our free STIGs for Dummies eBook. Before you know it, you’ll be a STIG ninja too.