UCF STIG Viewer Logo

A list of personnel authorized to administer each zone and name server is not maintained.


Overview

Finding ID Version Rule ID IA Controls Severity
V-13036 DNS0120 SV-13604r3_rule Low
Description
If an organization does not document who is responsible for the DNS function, then there is a significant potential that unauthorized individuals will obtain privileged access to name servers. During a security breach, it will be difficult to assign accountability for improper transactions if it is not known who is responsible for this function. The roles of the SA and the DNS administrator or DNS manager are generally understood but are often used interchangeably. The SA is responsible for the OS, while the DNS administrator or DNS manager usually manages the DNS zones. In some cases, the SA is also the DNS administrator/DNS manager, which is why guidance tends to be written in a certain fashion. The application development group should refer to the supporting organization for the application when application issues arise from meeting DNS server requirements.
STIG Date
DNS Policy 2018-04-05

Details

Check Text ( C-3358r4_chk )
Interview the ISSO and ask for the DNS server’s documented procedures and processes.

Verify the documented procedures and processes explicitly document the roles and responsibilities for the DNS server management. These documented roles will be used to validate access controls in respective DNS technology STIGs.

In some environments, the SA is also the DNS manager. In such case, the roles should still be documented.

If the organization does not have the DNS server roles documented, this is a finding.
Fix Text (F-4340r2_fix)
The ISSO must create and maintain a list of authorized DNS administrators for each zone and name server under the ISSOs scope of responsibility.