New capabilities automate STIG checks for cloud-native applications and provide security teams with a unified view of STIG compliance and vulnerabilities
Anchore today announced the release of Anchore Enterprise 3.1 that includes simplified STIG compliance for U.S. federal agencies. New capabilities in the federal edition automate STIG checks for cloud-native applications and provide security teams with a unified view on STIG compliance, vulnerabilities and other security issues.
The federal edition of Anchore Enterprise 3.1 simplifies the process of DISA STIG checks for containers running in a Kubernetes cluster. Federal agencies that need to comply with STIGs can automate a typically time intensive process. The resulting STIG checks are aggregated and correlated to provide security teams with a unified view on compliance issues and vulnerabilities.
Anchore’s approach to STIG validation is based on deep experience working with the U.S. Department of Defense and branches of the U.S. Armed Forces. The new STIG compliance capability performs the checks on running container instances using a lightweight agent which passes the result back to the Anchore Enterprise. The results are queried programmatically through an API that can be used to prove the compliance of an image for auditors or used as part of a policy to warn or fail a deployment.
“This new capability is based on collaboration with multiple agencies in the federal government and addresses the pain points they identified in automating the STIG process in a containerized environment,” said Neil Levine, Vice President of Product for Anchore. “Now, federal agencies can streamline DevSecOps for cloud-native applications by combining automated STIG checks and other security controls for a unified view of compliance.”
STIGs are configuration standards for information systems across the U.S. Department of Defense to ensure software security and decrease vulnerabilities. More information can be found at the DoD Cyber Exchange website.
