ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS05.0320 Synch\Maint Local Code Configuration Management
STIG ID \ V-Key DS05.0320 \ V0011767
Severity Cat III
Short Name Synch\Maint Local Code Configuration Management
IA Controls ECSD-1, ECSD-2
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.7
Long Name: There is no policy to ensure that code that is not vendor-provided and is used in a
synch\maint implementation that updates security principal accounts is subject to
a configuration management process.
Checks:
• Interview the Application SA.
• Determine if a synch\maint implementation that updates security principal
accounts includes code not provided by the vendor.
- For MIIS\IIFP, this refers to Management Agents (MAs) not provided from
Microsoft.
[Retain this code information for use in a subsequent check.]
• If the synch\maint implementation does *not* use non-vendor code, then this
check is Not Applicable.
• If the synch\maint implementation *does* use non-vendor code, obtain a copy of
the site’s configuration management procedures documentation.
• Verify that there is a local policy that requires implementation and changes to the
code to be processed through a configuration management process.
• If there is no policy that requires code implementation and changes to be
processed through a configuration management process, then this is a Finding.
UNCLASSIFIED
3-19