STIG Automation with Chef and InSpec
summary
Shows how to automate DoD STIGs for RHEL6 using Chef and InSpec with concrete commands and code patterns: ingest SCAP XML via the InSpec SCAP plugin, triage hundreds of controls down to applicable ones, author per-rule InSpec controls (map STIG IDs, impact → 0.5/1), and implement remediations with Chef cookbooks using file edit utilities and the line cookbook for idempotent search/replace. Includes test workflow with Test Kitchen and the audit cookbook, and artifact signing via inspect artifact (RSA).
AI-written summary · about
chapters (9)
- 0:00Start
- 6:07STIG describe
- 15:13Naming Conventions
- 16:31inspec.yml
- 25:19A word about Non Technical Controls
- 29:24Search and Replace
- 30:46The line cookbook
- 31:18Key Concept TDD
- 33:08Signing Comp Profiles
related talks
31mHow to Prepare for an Audit AKA Make Audits Suck Less
36mImproving Security while Reducing Toil with DevSecOps
49mBaking Safety into Infrastructure Testing
45mAudit and Assess the Security of Your Infrastructure
25mTransform Your Security Practices With DevOps
31mInfrastructure and Environment Testing with InSpec
39mTrust teams but verify: compliance as code done right
31mShifting Left Securely