ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS05.0340 Synch\Maint Aggregate Transport Encryption
STIG ID \ V-Key DS05.0340 \ V0011771
Severity Cat II
Short Name Synch\Maint Aggregate Transport Encryption
IA Controls ECCT-1, ECCT-2, ECNK-1, ECNK-2
MAC /Conf 1-CS, 2-CS, 3-CS
References AD STIG 2.3.3.8
Long Name: A synch\maint implementation that transfers a substantial aggregate of the
directory data for an entire geographic command does not use FIPS 140-2validated
encryption to protect the network traffic.
Checks:
• Interview the Application SA.
• Determine if data transmitted by the synch\maint implementation contains
directory information for an *entire* geographic command such as DISA
CONUS, DISA EUROPE, or DISA PACIFIC or for *all* members of a Service
or other Component.
- An examination of the application documentation or directory query strings can
be used to establish this.
• If the data transmitted by the synch\maint implementation does *not* contain
substantial aggregates, then this check is Not Applicable.
• If the data transmitted by the synch\maint implementation *does* contain a
substantial aggregate, review the application documentation and site network
diagram(s) to determine if FIPS 140-2-validated encryption is used to protect the
network traffic.
- This includes encryption of the data on the host before transmission, the use of
LDAPS or HTTPS protocol, or the use of network components (such as a VPN)
to perform encryption.
• If the data transmitted by the synch\maint implementation contains a substantial
aggregate and it is not encrypted, then this is a Finding.
UNCLASSIFIED
3-23