Locally written (non-vendor) code used in AD operations must comply with the requirements of the Application STIG.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14789	DS00.6110_2008_R2	SV-39009r1_rule	COSW-1	Low

Description
Unlike vendor programs that might be recovered by purchasing and\or downloading a replacement copy, the lack of a backup for locally written (non-vendor) code could result in the inability to recover from inadvertent or malicious deletion or simple hardware failure.

STIG	Date
Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide	2013-10-01

Details

Check Text ( C-38006r1_chk )
1. Interview the application SA or site representative. Ask if the site uses locally written applications running on the domain controllers. 2. If the site indicates AD directory maintenance does not use non-vendor code, then this check is not applicable. 3. If AD directory maintenance does use non-vendor code, obtain a copy of the security review results or other documentation which indicates the review was completed. A self-assessment using the Application STIG is acceptable. 4. If the non-vendor code has not been reviewed using the Application STIG since it was created or modified, then this is a finding.

Check Text ( C-38006r1_chk )

1. Interview the application SA or site representative. Ask if the site uses locally written applications running on the domain controllers.

2. If the site indicates AD directory maintenance does not use non-vendor code, then this check is not applicable.

3. If AD directory maintenance does use non-vendor code, obtain a copy of the security review results or other documentation which indicates the review was completed. A self-assessment using the Application STIG is acceptable.

4. If the non-vendor code has not been reviewed using the Application STIG since it was created or modified, then this is a finding.

Fix Text (F-33240r1_fix)
Perform a security review using the Application STIG.