Each cross-directory authentication configuration must be documented.

From Active Directory Domain Security Technical Implementation Guide (STIG)

Part of Cross-Directory Authentication Documentation

Associated with: CCI-000366

SV-30989r3_rule Each cross-directory authentication configuration must be documented.

Vulnerability discussion

Active Directory (AD) external, forest, and realm trust configurations are designed to extend resource access to a wider range of users (those in other directories). If specific baseline documentation of authorized AD external, forest, and realm trust configurations is not maintained, it is impossible to determine if the configurations are consistent with the intended security policy.

Check content

Start "Active Directory Domains and Trusts" (Available from various menus or run "domain.msc"). Select the left pane item that matches the name of the domain being reviewed. Right-click the domain name and select "Properties". Select the "Trusts" tab. For each outbound and inbound external, forest, and realm trust, record the name of the other party (domain name), the trust type, transitivity, and the trust direction. (Keep this trust information for use in subsequent checks.) Compare the list of trusts identified with documentation maintained by the ISSO. For each trust, the documentation must contain the following: Type (external, forest, or realm) Name of the other party Confidentiality, Availability, and Integrity categorization Classification level of the other party Trust direction (inbound and/or outbound) Transitivity Status of the Selective Authentication option Status of the SID filtering option If an identified trust is not listed in the documentation or if any of the required items are not documented, this is a finding.

Fix text

Develop documentation for each AD external, forest, and realm trust configuration. At a minimum this must include: Type (external, forest, or realm) Name of the other party Confidentiality, Availability, and Integrity categorization Classification level of the other party Trust direction (inbound and/or outbound) Transitivity Status of the Selective Authentication option Status of the SID filtering option

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer