From 888cbb787b87df102d7673b2231348f45e951aa7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 20 Dec 2025 02:27:50 +0000 Subject: [PATCH 1/2] Initial plan From bf8d402ca6a51f49fa171ebdf000079234adcdd2 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 20 Dec 2025 02:35:02 +0000 Subject: [PATCH 2/2] Changes before error encountered Co-authored-by: bgauger <92540908+bgauger@users.noreply.github.com> --- .gitignore | 60 +++++++++++++++++ CHANGELOG.md | 58 +++++++++++++++++ CONTRIBUTING.md | 170 ++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 144 ++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 116 +++++++++++++++++++++++++++++++++ 5 files changed, 548 insertions(+) create mode 100644 .gitignore create mode 100644 CHANGELOG.md create mode 100644 CONTRIBUTING.md create mode 100644 README.md create mode 100644 SECURITY.md diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0224abe --- /dev/null +++ b/.gitignore @@ -0,0 +1,60 @@ +# PowerShell +*.ps1xml +*_profile.ps1 + +# Staging and temporary directories +StigPrep/ +C:\StigPrep/ + +# Log files +*.log +*.txt.log +*.err +*.error + +# Backup files +*.bak +*.backup +*.old + +# Windows artifacts +Thumbs.db +Desktop.ini +$RECYCLE.BIN/ + +# PowerShell module cache +PSGetModuleInfo.xml + +# Credential files +*.credential +*.cred +*password* +*secret* + +# Archived files (consider removing from repo) +*.zip +*.7z +*.rar + +# Build artifacts +bin/ +obj/ +out/ + +# IDE and Editor files +.vscode/ +.vs/ +*.suo +*.user +*.userosscache +*.sln.docstates + +# Mac files +.DS_Store +.AppleDouble +.LSOverride + +# Temporary files +*.tmp +*.temp +~$* diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..7a0e675 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,58 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added +- Comprehensive README.md with usage instructions and prerequisites +- CONTRIBUTING.md with contribution guidelines +- SECURITY.md with security policy and vulnerability reporting +- CODE_OF_CONDUCT.md for community standards +- CHANGELOG.md for tracking version history +- .gitignore for PowerShell and Windows artifacts +- .editorconfig for consistent code formatting +- GitHub Actions workflow for PowerShell linting +- GitHub issue templates for bugs and feature requests +- GitHub pull request template + +### Changed +- Renamed `set_tls..ps1` to `set_tls.ps1` (fixed double dots typo) + +### Fixed +- Repository structure documentation +- File naming consistency + +## [1.0.0] - 2022-10-25 + +### Added +- Windows Server 2019 STIG configuration script (Win2019-STIG.ps1) +- IIS 10.0 Server STIG script v2.5 +- IIS 10.0 Site STIG script v2.5 +- TLS/SSL security configuration script +- Modular PowerShell modules for various applications: + - Adobe Reader + - Chrome + - Defender + - DotNet + - Edge + - Firefox + - Firewall + - IE11 + - IIS Server and Site + - Office 2016 and 2019 + - Excel, PowerPoint, Word +- STIG evaluation answer files for IL4 +- Support for multiple STIG categories + +### Initial Release Notes +- Based on DISA STIG guidance +- IIS 10.0 STIG Version 2, Release 5 (27 Jan 2022) +- Supports Windows Server 2019 and compatible versions +- MIT License + +[Unreleased]: https://github.com/bgauger/Compliance_as_Code/compare/v1.0.0...HEAD +[1.0.0]: https://github.com/bgauger/Compliance_as_Code/releases/tag/v1.0.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..3b81907 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,170 @@ +# Contributing to Compliance as Code + +Thank you for your interest in contributing to the Compliance as Code project! This document provides guidelines for contributing to this repository. + +## How to Contribute + +### Reporting Issues + +If you find a bug or have a suggestion for improvement: + +1. Check the [Issues](https://github.com/bgauger/Compliance_as_Code/issues) to see if it has already been reported +2. If not, create a new issue with: + - Clear title and description + - Steps to reproduce (for bugs) + - Expected vs actual behavior + - System information (Windows version, PowerShell version) + - STIG version being targeted + +### Submitting Changes + +1. **Fork the repository** and create a new branch for your changes + ```powershell + git checkout -b feature/your-feature-name + ``` + +2. **Make your changes** following the coding guidelines below + +3. **Test your changes** thoroughly in a test environment + +4. **Commit your changes** with clear, descriptive commit messages + ```powershell + git commit -m "Add feature: description of what you added" + ``` + +5. **Push to your fork** and submit a pull request + ```powershell + git push origin feature/your-feature-name + ``` + +## Coding Guidelines + +### PowerShell Style + +- Use **PascalCase** for function names: `Get-StigConfiguration` +- Use **camelCase** for variable names: `$stagingPath` +- Use **verb-noun** naming convention for functions +- Include **comment-based help** for all functions and scripts +- Use **4 spaces** for indentation (not tabs) +- Keep lines under **120 characters** when possible + +### Script Structure + +1. **Header comment block** with: + - Synopsis + - Description + - Parameters + - Examples + - Notes (author, version history) + +2. **Parameters section** with validation + +3. **Functions** before main script logic + +4. **Main script logic** with proper error handling + +### Example Format + +```powershell +<# +.SYNOPSIS + Brief description of the script + +.DESCRIPTION + Detailed description of what the script does + +.PARAMETER ParameterName + Description of the parameter + +.EXAMPLE + .\Script-Name.ps1 -ParameterName "Value" + +.NOTES + Author: Your Name + Date: YYYY-MM-DD + Version: 1.0 +#> + +[CmdletBinding()] +Param( + [Parameter(Mandatory=$true)] + [string]$ParameterName +) + +function Verb-Noun { + [CmdletBinding()] + Param( + [Parameter(Mandatory=$true)] + [string]$Parameter + ) + + # Function logic here +} + +# Main script logic +try { + # Your code here +} +catch { + Write-Error "Error message: $_" + exit 1 +} +``` + +## Testing + +- **Test in a non-production environment** before submitting +- Verify scripts run without errors on target systems +- Check that STIG requirements are properly implemented +- Validate that scripts are idempotent (can be run multiple times safely) +- Test both success and failure scenarios + +## Documentation + +- Update **README.md** if adding new features or scripts +- Document all **parameters** and their acceptable values +- Provide **usage examples** for new scripts +- Update **CHANGELOG.md** with your changes +- Include **inline comments** for complex logic + +## STIG Compliance + +- Reference the **specific STIG version** being implemented +- Include **STIG IDs** (e.g., V-93345) in comments where applicable +- Verify against the **official STIG documentation** +- Document any **deviations** or **non-applicable** items + +## Security Considerations + +- **Never commit credentials** or sensitive information +- Ensure scripts follow **principle of least privilege** +- Validate all **user inputs** +- Use **secure coding practices** +- Consider **audit logging** for configuration changes + +## Pull Request Process + +1. Ensure your code follows the coding guidelines +2. Update documentation as needed +3. Add a clear description of changes in the PR +4. Reference any related issues +5. Wait for review and address any feedback +6. Once approved, your PR will be merged + +## Code of Conduct + +Please note that this project follows a Code of Conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to the project maintainers. + +## Questions? + +If you have questions about contributing, please: +- Open an issue for discussion +- Contact the maintainer: bgauger@quantum-intl.com + +## License + +By contributing, you agree that your contributions will be licensed under the MIT License. + +--- + +Thank you for helping improve Compliance as Code! diff --git a/README.md b/README.md new file mode 100644 index 0000000..94d13e5 --- /dev/null +++ b/README.md @@ -0,0 +1,144 @@ +# Compliance as Code + +A collection of PowerShell scripts for automated Security Technical Implementation Guide (STIG) compliance configuration and evaluation for Windows Server and IIS environments. + +## Overview + +This repository provides automated compliance-as-code solutions to configure Windows systems according to DISA STIG requirements. The scripts help system administrators apply and validate security configurations efficiently and consistently. + +## Repository Structure + +``` +Compliance_as_Code/ +├── ConfigureSTIG/ # Scripts to configure systems for STIG compliance +│ ├── IIS10/ # IIS 10.0 STIG configuration scripts +│ ├── TLS/ # TLS/SSL security configuration +│ └── winsvr2019/ # Windows Server 2019 STIG configuration +│ ├── Modules/ # PowerShell modules for various applications +│ └── Support Files/ # Additional support files and resources +└── EvalSTIG/ # STIG evaluation and validation + └── AnswerFilesIL4/ # Answer files for STIG Viewer assessments +``` + +## Features + +### Configuration Scripts + +- **Windows Server 2019 STIG** (`ConfigureSTIG/winsvr2019/Win2019-STIG.ps1`) + - Comprehensive STIG configuration for Windows Server 2019 + - Modular design with support for multiple application STIGs + - Includes STIGs for: Adobe Reader, Chrome, Defender, DotNet, Edge, Firefox, Firewall, IE11, IIS, Office, and more + +- **IIS 10.0 STIG** + - Server configuration: `ConfigureSTIG/IIS10/IIs10-Server-STIG_v2.5.ps1` + - Site configuration: `ConfigureSTIG/IIS10/IIs10-Site-STIG_v2.5.ps1` + - Based on IIS 10.0 STIG Version 2, Release 5 (27 Jan 2022) + +- **TLS/SSL Security** (`ConfigureSTIG/TLS/set_tls.ps1`) + - Disables weak protocols (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) + - Enables strong protocols (TLS 1.2, TLS 1.3) + - Configures secure cipher suites and hashing algorithms + +## Prerequisites + +- **Operating System**: Windows Server 2019 or compatible Windows version +- **PowerShell**: Version 5.1 or higher +- **Permissions**: Administrator privileges required +- **IIS**: Internet Information Services (for IIS STIG scripts) + +## Usage + +### Basic Usage + +1. **Clone the repository**: + ```powershell + git clone https://github.com/bgauger/Compliance_as_Code.git + cd Compliance_as_Code + ``` + +2. **Run with Administrator privileges**: + ```powershell + # Right-click PowerShell and select "Run as Administrator" + ``` + +3. **Execute STIG configuration scripts**: + + ```powershell + # Windows Server 2019 STIG + .\ConfigureSTIG\winsvr2019\Win2019-STIG.ps1 + + # With specific category + .\ConfigureSTIG\winsvr2019\Win2019-STIG.ps1 -Cat "Server2019" + + # IIS Server STIG + .\ConfigureSTIG\IIS10\IIs10-Server-STIG_v2.5.ps1 + + # IIS Site STIG + .\ConfigureSTIG\IIS10\IIs10-Site-STIG_v2.5.ps1 + + # TLS/SSL Configuration + .\ConfigureSTIG\TLS\set_tls.ps1 + ``` + +### Windows Server 2019 Script Parameters + +```powershell +.\ConfigureSTIG\winsvr2019\Win2019-STIG.ps1 ` + -Cat "Server2019" ` + -StagingPath "C:\StigPrep" ` + -EnableCleanup "Yes" +``` + +**Parameters:** +- `-Cat`: STIG category to apply (Server2019, IISSvr, DevWS, TestWS, NetOpsWS, SQL) +- `-StagingPath`: Directory for temporary files (default: C:\StigPrep) +- `-EnableCleanup`: Clean up temporary files after execution (Yes/No, default: Yes) + +## Important Notes + +⚠️ **WARNING**: These scripts make significant system configuration changes. + +- **Test in a non-production environment first** +- **Create system backups** before running any scripts +- **Review scripts** to understand the changes being made +- **Verify compliance requirements** match your organization's needs +- Some changes may require a **system restart** to take effect + +## STIG Versions + +Scripts are based on the following STIG versions: +- Windows Server 2019: Various application STIGs +- IIS 10.0 Server/Site: Version 2, Release 5 (27 Jan 2022) + +Always verify you're using the appropriate STIG version for your compliance requirements. + +## Evaluation and Validation + +The `EvalSTIG/AnswerFilesIL4/` directory contains answer files for use with DISA STIG Viewer to evaluate and document compliance status. + +## Contributing + +Contributions are welcome! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. + +## Security + +For reporting security vulnerabilities, please see [SECURITY.md](SECURITY.md). + +## License + +This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details. + +## Author + +**Original Author**: Ben Gauger, Quantum Research International +**Email**: bgauger@quantum-intl.com + +## References + +- [DISA STIGs](https://public.cyber.mil/stigs/) +- [STIG Viewer](https://public.cyber.mil/stigs/srg-stig-tools/) +- [PowerShell Documentation](https://docs.microsoft.com/en-us/powershell/) + +## Disclaimer + +This software is provided "as is" without warranty of any kind. Users are responsible for testing and validating these scripts in their environment and ensuring they meet their specific compliance requirements. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..2d30d8e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,116 @@ +# Security Policy + +## Supported Versions + +We release patches for security vulnerabilities in the following versions: + +| Version | Supported | +| ------- | ------------------ | +| Latest | :white_check_mark: | +| < Latest| :x: | + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues.** + +The security of our compliance automation scripts is important. If you discover a security vulnerability, please follow these steps: + +### 1. Contact + +Send an email to: **bgauger@quantum-intl.com** + +Please include: +- Type of vulnerability +- Full paths of source file(s) related to the vulnerability +- Location of the affected source code (tag/branch/commit or direct URL) +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if possible) +- Impact of the vulnerability, including how an attacker might exploit it + +### 2. Response Timeline + +- **Initial Response**: Within 48 hours, we will acknowledge receipt of your vulnerability report +- **Status Update**: Within 7 days, we will provide a detailed response indicating the next steps +- **Resolution**: We aim to release patches or mitigations within 30 days for critical vulnerabilities + +### 3. Disclosure Policy + +- Please allow us reasonable time to fix the vulnerability before public disclosure +- We will credit you for the discovery (unless you prefer to remain anonymous) +- We will keep you informed of our progress toward resolution + +## Security Considerations for Users + +### Script Execution + +These scripts make significant system configuration changes. Before running: + +1. **Review the Code**: Always review scripts before execution to understand what changes will be made +2. **Test Environment**: Test in a non-production environment first +3. **Backups**: Create full system backups before applying STIG configurations +4. **Execution Policy**: Ensure your PowerShell execution policy is set appropriately +5. **Administrator Rights**: Scripts require administrative privileges - ensure proper authorization + +### Best Practices + +- **Never commit credentials** to version control +- **Use secure channels** when transferring scripts between systems +- **Verify script integrity** - consider implementing script signing +- **Audit logging** - enable logging to track configuration changes +- **Regular updates** - keep scripts updated with latest STIG versions +- **Principle of least privilege** - only run with necessary permissions + +### Known Security Considerations + +1. **Administrative Privileges**: Scripts require administrator access to modify system configurations +2. **System Changes**: Scripts make permanent changes to Windows registry, policies, and configurations +3. **Service Impact**: Some configurations may impact system services and applications +4. **Network Security**: TLS/SSL scripts affect network communication security settings + +### Credential Handling + +- Scripts should **never** store or log passwords or credentials +- Use **secure credential management** solutions (e.g., Azure Key Vault, CyberArk) +- Avoid passing credentials as command-line parameters +- Use **PowerShell SecureString** for sensitive data when necessary + +### Compliance and Auditing + +- These scripts implement DISA STIG requirements, but **verification is required** +- Use **STIG Viewer** or other compliance tools to validate configurations +- Maintain **audit logs** of when and what configurations were applied +- Regularly **review and update** to latest STIG versions + +## Security Updates + +Security updates will be released as needed and documented in: +- GitHub Security Advisories +- CHANGELOG.md +- Release notes + +## Scope + +This security policy applies to: +- All PowerShell scripts in this repository +- Configuration files and modules +- Documentation that impacts security + +## Out of Scope + +- Third-party dependencies and their vulnerabilities +- Security issues in Windows OS itself (report to Microsoft) +- Security issues in applications being configured (report to respective vendors) + +## Additional Resources + +- [DISA STIG Information](https://public.cyber.mil/stigs/) +- [PowerShell Security Best Practices](https://docs.microsoft.com/en-us/powershell/scripting/security/overview) +- [Windows Security Baseline](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines) + +## Questions + +For questions about this security policy, contact: bgauger@quantum-intl.com + +--- + +**Note**: This project is provided "as is" without warranty. Users are responsible for testing and validating in their environment.