ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0110 AD Inter-Enclave VPN Usage
STIG ID \ V-Key DS10.0110 \ V0008522
Severity Cat II
Short Name AD Inter-Enclave VPN Usage
IA Controls DCPP-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.1.3
DODI 8551.1
Long Name: An AD implementation (domains or forest) that spans enclave boundaries does
not use a VPN to protect AD network traffic.
Checks:
• Interview the IAM.
• With the assistance of the SA, NSO, or network reviewer as required, review the
site network diagram(s) to determine if domain controllers for the AD forest are
located in multiple enclaves.
- The object is to determine if AD network traffic is traversing enclave network
boundaries.
• If domain controllers are *not* located in multiple enclaves, then this check is
Not Applicable.
• If domain controllers are located in multiple enclaves, verify that a VPN is used to
transport the AD network traffic (replication, user logon, AD queries, etc.).
[Retain this location and VPN information for use in a subsequent check.]
• If a VPN solution is not used to transport AD network traffic across enclave
boundaries, then this is a Finding.
Note: This check and the associated requirement are based on DoD ports and
protocols restrictions stated in DoD Instruction 8551.1 and linked documents.
UNCLASSIFIED
3-6