Oracle Linux 8 STIG Compliance (Ver 2, Rel 7)

16 items · Security · Hard difficulty · 4 hours

Practical steps to assess and remediate Oracle Linux 8 STIG compliance.

• Review Oracle Linux 8 STIG checklist details

  Confirm checklist ID 1004, Ver 2 Rel 7, scope, and summary before starting.

• Download SCAP and supporting content

  Gather official SCAP, XCCDF, and automated content referenced by DISA.

• Download SCAP 1.3 content for Oracle Linux 8 STIG

  Get the SCAP 1.3 Benchmark (Ver 2, Rel 7) for accurate scanning.

• Download Standalone XCCDF 1.1.4 for Oracle Linux 8 STIG

  Obtain XCCDF content for manual review and tool compatibility.

• Download automated SCC content for Oracle Linux 8 x86_64

  Grab SCC automated content for remediation and scanning where available.

• Verify system CPE matches Oracle Linux 8.0

  Check host CPE (cpe:/o:oracle:linux:8.0) to ensure the STIG applies.

• Apply OS updates and security patches

  Install latest kernel and security packages before scanning.

• Harden system configuration per STIG

  Implement configuration baselines and controls listed in the STIG.

• Disable unused services and packages

  Stop and mask non-required services to reduce attack surface.

• Enforce password, account and authentication policies

  Set complexity, lockout, expiration, and sudo restrictions per STIG.

• Enable and configure auditd and centralized logging

  Ensure audit rules cover privileged actions and logs are retained/forwarded.

• Deploy Ansible or automated remediation content

  Use DISA Ansible/XCCDF playbooks or SCC content to apply remediations.

• Run SCAP/XCCDF compliance scan and review findings

  Use OpenSCAP or SCC tools to generate a compliance report for the host.

• Remediate failures and re-scan

  Address findings, apply fixes, then re-run scans to confirm compliance.

• Document exceptions and submit change requests if needed

  Record deviations and email proposed revisions to [email protected].

• Schedule regular rescans and monitor DISA resource updates

  Subscribe to DISA updates and refresh SCAP/XCCDF/SHAs as resources change.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.