ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS05.0380 Synch\Maint Privileged Remote Access Control
STIG ID \ V-Key DS05.0380 \ V0011774
Severity Cat II
Short Name Synch\Maint Privileged Remote Access Control
IA Controls EBRP-1
MAC /Conf 1-CS, 2-CS, 3-CS
References AD STIG 2.3.4
Long Name: Privileged remote access to a synch\maint implementation is not implemented
through a managed access control point and with increased session security
mechanisms.
Checks:
• Interview the Application SA.
• With the assistance of the SA, NSO, or network reviewer as required, review the
site network diagram(s) and application documentation to determine if the
synch\maint implementation supports and utilizes *privileged* remote access.
- For example, determine if the application SA located in one enclave can access
the server hosting the synch\maint implementation in another enclave.
[Retain this remote access information for use in a subsequent check.]
• If the synch\maint implementation does *not* support privileged remote access,
then this check is Not Applicable.
• If the synch\maint implementation *does* support and utilize privileged remote
access, review the site network diagram(s) with the assistance of the SA, NSO, or
network reviewer as required, to determine if a managed access control point with
increased session security mechanisms (such as two-factor authentication) is used.
- A remote access server (RAS) located in a DMZ is an example of a compliant
solution. Additional information for remote access solutions is located in the
Network Infrastructure STIG.
• If the synch\maint implementation supports and utilizes privileged remote access
and the appropriate access controls are not used, then this is a Finding.
UNCLASSIFIED
3-26