On 11/27/18 2:06 PM, James Ralston wrote: Not being snide, should this come across wrongly.... genuine question: Why use STIG Viewer in the first place? Wonder if this is something that could be incorporated into Security Central? /me glances at @Gabe Alford

On Tue, Nov 27, 2018, at 6:21 PM, Shawn Wells wrote: [...] The STIG Viewer produces *.ckl checklist files, which some auditors and many security departments want. V/r, James Cassell

Yep, this is the one. That said, if you dig through the archives of this mailing list, I figured out how to create the bare minimum .ckl file that you need for reporting so that should give people a head start. On Wed, Nov 28, 2018 at 1:31 AM Matthew <simontek(a)gmail.com&gt; wrote: -- Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 x788 -- This account not approved for unencrypted proprietary information --

“genuine question: Why use STIG Viewer in the first place?” This is the tool DISA uses to conduct line by line audits of manual & automated results during readiness inspections. We use it for regular internal review of STIG posture, benchmark and manual, in order that we are familiar with the tool. It provides a common tool to use between the various customers locally that require and review the information to determine the security posture of their own systems. There may be other tools that may in fact be better, but I’d much rather be familiar and competent with what the auditors will use when crawling over the systems. Thanks, Mark Salowitz, CTR CTS II PaaS Engineer USCG Operations Systems Center From: Shawn Wells <shawn(a)redhat.com&gt; Sent: Tuesday, November 27, 2018 6:22 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: [Non-DoD Source] Re: alternatives to STIG Viewer once Oracle JDK 8 / JavaFX 8 is EOL in January 2019? On 11/27/18 2:06 PM, James Ralston wrote: I apologize if this is a little off-topic for this list, but a question: what are others who use STIG Viewer planning to do once Oracle JDK 8 / JavaFX go EOL in January 2019? Any Oracle Java 8 security updates released after January 2019 will require a commercial support license from Oracle: https://developers.redhat.com/blog/2018/11/05/migrating-from-oracle-jdk-t... STIG Viewer requires Oracle JDK 8 and JavaFX 8 in order to function. Oracle JDK 11 is the next LTS (long term support) version of Java. (Java 9 and Java 10 are not LTS releases, and are already EOL.) But in Java 11, Oracle removed JavaFX: https://www.infoworld.com/article/3305073/java/removed-from-jdk-11-javafx... The OpenJFX project provides a JavaFX 11 implementation that works with OpenJDK 11: https://openjfx.io/<https://urldefense.proofpoint.com/v2/url?u=https-3... But: I tested the latest STIG Viewer (version 2.8) with OpenJDK 11 / OpenJFX 11, and it does not work; it simply crashes at startup. This will shortly place all STIG Viewer users in the situation where they must purchase a commercial support contract from Oracle in order to run STIG Viewer, because STIG Viewer requires outdated / EOL technology. I asked DISA/IASE what their intentions were with STIG Viewer in light of this. As of 2018-11-27, this was their response: There are currently no plans on creating a non-Oracle java version of STIG Viewer at this time. We also have no information regarding how DoD will be addressing the licensing requirement for Oracle java going forward. So. Ideally, I'd like to find a Linux replacement for STIG Viewer—something that can read, annotate, and write STIG Viewer checklist (*.ckl) files. But although SCAP Workbench can load and check STIGs, unless I'm missing something, it has no support for STIG Viewer checklist files. Not being snide, should this come across wrongly.... genuine question: Why use STIG Viewer in the first place? I can't be the only person in this boat. What are others doing? Wonder if this is something that could be incorporated into Security Central? /me glances at @Gabe Alford