Achieving DISA STIG Certification for MKE: Challenges, Successes & Best Practices for Compliant Public Sector Solutions

In this month's episode, John Jainschigg, Director of Open Source Initiatives at Mirantis hosts Kathleen Moyer, Director of Service Delivery at Corsec Security, and William Konitzer, Senior Solution Architect at Mirantis, to explore the recently achieved DISA STIG certification for Mirantis Kubernetes Engine (MKE). Together, they dive into the intricate certification process that enables public sector and enterprise users to deploy secure, compliant applications using MKE.Listeners will gain insights into the collaborative effort between Mirantis and Corsec Security, where Kathleen shares her 25 years of expertise in security certifications, detailing how Corsec facilitated the process with government agencies like DISA and the DoD. William provides a behind-the-scenes look at the technical challenges and solutions that ensured MKE met stringent Department of Defense (DoD) security standards without compromising usability or performance. Furthermore, he highlights some of the team's learnings in the context of how it changed the thought process of Mirantis' engineering teams when it came to security.Achieved in early 2024, this milestone positions MKE as a powerful tool for public sector organizations and industries with specific security and compliance needs. Whether you’re navigating public sector compliance requirements or interested in secure cloud native solutions, this episode offers practical advice and unique perspectives on implementing and managing a STIG-compliant Kubernetes platform.A full list of this episode's topics include:Corsec Security's role in the MKE DISA STIG processCommon challenges Orgs face in STIG processHow Corsec handles security testing to ensure complianceSITG vs FEDRAMP - in terms of requirementsHow Corsec handles product updates re: the STIGAdvice for companies getting started with STIG certificationRole of documentation in STIG processChallenges in MKE STIG processWhy Mirantis did a STIG for MKESpecific security features of MKE that affected DISA STIG approvalMirantis and Corsec collaborationMKE for the Public SectorTimelines for achieving STIG certificationMitigating evolving vulnerabilitiesHow the SITG process for MKE impacted Mirantis engineeringIf you want to listen to more episodes of Radio Cloud Native, please visit https://www.mirantis.com/radiocloudnative/ to download, or find them wherever you prefer to consume your podcasts.If you are interested in contributing to Radio Cloud Native, please reach out to our podcast team: [email protected]