ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS05.0220 Synch\Maint PKI Certificate Source
STIG ID \ V-Key DS05.0220 \ V0011783
Severity Cat II
Short Name Synch\Maint PKI Certificate Source
IA Controls IAKM-1, IAKM-2, IATS-1, IATS-2
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.2
Long Name: PKI certificates used in a directory synchronization or maintenance application
are not issued by the DoD PKI.
Checks:
• With the assistance of the application SA, display all PKI certificate(s) being used
by the synchronization or maintenance application.
- For applications accessing directory data through LDAPS, this would include
the certificate installed on the directory server.
-- For MIIS\IIFP or SimpleSync accessing AD, this would include the domain
controller certificate.
- For applications accessing directory data through HTTPS, this would include the
certificate installed on the web server that provides DSML access.
• If any PKI certificate being used in a synchronization or maintenance function is
not issued by the DoD PKI and there is no written plan to implement DoD PKI
certificates (per the note below), then this is a Finding.
Note: Prior to DoD PKI support for Windows domain controller certificates, some
Components established alternate (Microsoft Windows-based) Certificate Authorities
(CAs) to provide certificates. As of December 2005, Windows domain controller
certificates are available from the DoD PKI. Per guidance in JTF-GNO
Communications Tasking Order (CTO) 06-02, a plan to implement DoD PKI
certificates must be established no later than 31 July 2006.
UNCLASSIFIED
5-32