ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0300 IDS Visibility of AD VPN Data Transport
STIG ID \ V-Key DS10.0300 \ V0008523
Severity Cat II
Short Name IDS Visibility of AD VPN Data Transport
IA Controls EBVC-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.4
Long Name: The VPN used to protect AD network traffic does not support visibility by an
IDS.
Checks:
• Interview the IAO.
• If the response to check DS10.0110 indicates that domain controllers are *not*
located in multiple enclaves, then this check is Not Applicable.
• If the response to check DS10.0110 indicates that domain controllers *are*
located in multiple enclaves and a VPN is *not* used, then this check is Not
Applicable.
• If the response to check DS10.0110 indicates that domain controllers *are*
located in multiple enclaves and a VPN *is* used, review the site network
diagram(s) with the SA, NSO, or network reviewer as required to determine if the
AD network traffic is visible to a network or host IDS.
• If the AD network traffic is not visible to a network or host IDS, then this is a
Finding.
UNCLASSIFIED
3-7