A list of personnel authorized to administer each zone and name server is not maintained.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-13036	DNS0120	SV-13604r3_rule		Low

Description
If an organization does not document who is responsible for the DNS function, then there is a significant potential that unauthorized individuals will obtain privileged access to name servers. During a security breach, it will be difficult to assign accountability for improper transactions if it is not known who is responsible for this function. The roles of the SA and the DNS administrator or DNS manager are generally understood but are often used interchangeably. The SA is responsible for the OS, while the DNS administrator or DNS manager usually manages the DNS zones. In some cases, the SA is also the DNS administrator/DNS manager, which is why guidance tends to be written in a certain fashion. The application development group should refer to the supporting organization for the application when application issues arise from meeting DNS server requirements.

Description

If an organization does not document who is responsible for the DNS function, then there is a significant potential that unauthorized individuals will obtain privileged access to name servers. During a security breach, it will be difficult to assign accountability for improper transactions if it is not known who is responsible for this function. The roles of the SA and the DNS administrator or DNS manager are generally understood but are often used interchangeably. The SA is responsible for the OS, while the DNS administrator or DNS manager usually manages the DNS zones. In some cases, the SA is also the DNS administrator/DNS manager, which is why guidance tends to be written in a certain fashion. The application development group should refer to the supporting organization for the application when application issues arise from meeting DNS server requirements.

STIG	Date
DNS Policy	2018-04-05

Details

Check Text ( C-3358r4_chk )
Interview the ISSO and ask for the DNS server’s documented procedures and processes. Verify the documented procedures and processes explicitly document the roles and responsibilities for the DNS server management. These documented roles will be used to validate access controls in respective DNS technology STIGs. In some environments, the SA is also the DNS manager. In such case, the roles should still be documented. If the organization does not have the DNS server roles documented, this is a finding.

Check Text ( C-3358r4_chk )

Interview the ISSO and ask for the DNS server’s documented procedures and processes.

Verify the documented procedures and processes explicitly document the roles and responsibilities for the DNS server management. These documented roles will be used to validate access controls in respective DNS technology STIGs.

In some environments, the SA is also the DNS manager. In such case, the roles should still be documented.

If the organization does not have the DNS server roles documented, this is a finding.

Fix Text (F-4340r2_fix)
The ISSO must create and maintain a list of authorized DNS administrators for each zone and name server under the ISSOs scope of responsibility.