I have to run STIGs all the time on 450+ linux systems being a Linux Admin and all. STIGs are a good starting point, however the word guidance is in their acro

I have to run STIGs all the time on 450+ linux systems being a Linux Admin and all. STIGs are a good starting point, however the word guidance is in their acronym for a reason. Other security has to be considered. At our facility we have a "check box" security department. The entity above us is so concerned about STIG findings and if they are checked of of the list, other vulnerabilities are left to the wayside. I once got in an argument about outdated embedded versions of java in applications we use. some were up to 7 years old. I advised that we contact vendors, but being an systems admin that was up to the individual application administrators. I was told it didn't show up on scans and to shut up and color (OK they were a little nicer to me than that, same message though). I can see how places might be lacking in security if they have the same mentality as here.