ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0350 Trust Relationship INFOCON Procedures
STIG ID \ V-Key DS10.0350 \ V0008526
Severity Cat III
Short Name Trust Relationship INFOCON Procedures
IA Controls VIIR-1, VIIR-2
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.7
Strategic Command Directive (SD) 527-1
Long Name: AD trust relationships have not been evaluated with respect to possible
INFOCON procedures.
Checks:
• Interview the IAO.
• Refer to the list of actual trusts obtained in check DS10.0100.
*Note* - Check DS10.0100 (V0008530) is a manual check located in Section 5,
Manual Check Procedures.
• If there are no external, forest, or realm AD trust relationships, this check is Not
Applicable.
• Obtain a copy of the site’s supplemental INFOCON procedures as required by
Strategic Command Directive (SD) 527-1.
• Verify that it has been determined by the IAM whether INFOCON response
actions are to include procedures to disable external, forest, or realm AD trust
relationships.
- The object is to determine if the need has been explicitly evaluated.
• If it has been determined that actions to disable AD trust relationships *are not*
required, then this check is Not Applicable.
• If it has been determined that actions to disable AD trust relationships *are*
required, verify that the policy to implement these actions has been documented.
• If actions to disable AD trust relationships *are* required and no policy has been
documented, then this is a Finding.
UNCLASSIFIED
3-9