Windows 8, IE10

[sdnewman]

Can you provide any guidance for securing Windows 8 systems? Should we use Windows 7 USGCB? Same question regarding IE10. Any idea about when updates could become available?

Thanks

[gunnar]

Sadly, no, we have not yet seen any guidance for Windows 8 that can be turned into a benchmark, let alone an actual USGCB benchmark. You can certainly use the Advanced interface for Secutor Prime to bypass the CPE check and force the existing Windows 7 benchmark to be run against a Windows 8 asset. This can be informational and can give you some ideas about the management of Windows 8 devices, but should not be considered authoritative.

The news for Internet Explorer 10 is a little better. While there is also nothing actionable under USGCB, DISA has already released a STIG for IE10 in SCAP format which we are making part of the next Secutor Prime update. This update should be available within the next couple of days.

You can certainly go to DISA and download and use any of their SCAP content in Secutor Prime at any time, just like you can for any SCAP-compliant benchmarks. We consistently find SCAP errors in the DISA-produced benchmarks, however, so if this is not time-critical we recommend waiting until we can make corrections to these benchmarks at which point we will make them available as an automatic Prime update. This also gives us an opportunity to make remediation based on those benchmarks available.

[Randy]

DISA recently released SCAP content for Windows 8 and IE10. This will be rolled into Secutor Prime's content bundle with our next product release. You can download the content and use it with Secutor Prime until then.

http://iase.disa.mil/stigs/scap/index.html