Strolling Through the STIG

The CKL file has become the unofficial common language amongst the Department of Defense activities to share and report on STIG compliance information. Although easy to work with on an individual basis (One System / One Assessment), this format fails at scale. STIG Management tools are available and actively maintained but often require additional servers to function.

This research demonstrates how a new tool, Stroll, avoids the additional hardware requirements by living off the land. Stroll is a PowerShell module available on Github that automates the most common checklist management functions. This allows an Information System Security Officer to perform STIG Automation tasks at scale from a simple workstation.