Access to need-to-know information must be restricted to an authorized community of interest.

From Active Directory Domain Security Technical Implementation Guide (STIG)

Associated with IA controls: ECAN-1

Associated with: CCI-000366

SV-9030r2_rule Access to need-to-know information must be restricted to an authorized community of interest.

Vulnerability discussion

Because trust relationships effectively eliminate a level of authentication in the trusting domain or forest, they represent less stringent access control at the domain or forest level in which the resource resides. To mitigate this risk, trust relationships must be documented so that they can be readily verified during periodic inspections designed to validate only approved trusts are configured in AD.

Check content

1. Before performing this check, perform V-8530 which validates the trusts within the documentation are current within AD. 2. Obtain documentation of the site's approved trusts from the site representative. 3. For each of the identified trusts, verify that the documentation includes a justification or explanation of the need-to-know basis of the trust. 4. If the need for the trust is not documented, then this is a finding.

Fix text

Delete the unneeded trust relationship or document the access requirement or mission need for the trust.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.