ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0181 Trust Relationship Inter-Organization
STIG ID \ V-Key DS10.0181 \ V0008536
Severity Cat I
Short Name Trust Relationship Inter-Organization
IA Controls ECIC-1
MAC /Conf 1-CS, 2-CS, 3-CS
References AD STIG 2.3.3.2
Network Infrastructure STIG 3.1
Long Name: An external, forest, or realm AD trust relationship is defined between a DoD
system and a non-DoD system without explicit approval of the DAA and
appropriate documentation of the external network connection(s).
Checks:
• Refer to the list of actual trusts obtained in check DS10.0100.
• For each of the actual trusts, determine if the other trust party is a non-DoD entity.
For example, if the fully qualified domain name of the other party does not end in
“.mil”, the other party is probably not a DoD entity.
• Review the local documentation approving the external network connection and
documentation indicating explicit approval of the trust by the DAA.
- The external network connection documentation is maintained by the IAO\NSO
for compliance with the Network Infrastructure STIG.
• If any trust is defined with a non-DoD system and there is no documentation
indicating approval of the external network connection *and* explicit DAA
approval of the trust, then this is a Finding.
UNCLASSIFIED
5-18