| As most accounts in the domain name system are privileged or system level accounts, account management and distribution is vital to the security of the DNS implementation and infrastructure. If an attacker compromises an account, the entire DNS infrastructure, not to mention the hosts on the network, is at risk. Authentication for user or administrative access to the system is required at all times.
Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. For example, a temporary account could be created for vendor support use in order to perform diagnostics or assist in implementation.
Temporary accounts are not to be confused with infrequently used accounts (e.g., local login accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic termination dates.
If accounts intended to be temporary remain active when no longer needed, they may be used to gain unauthorized access with privileged level access. To reduce this risk, automated termination of all temporary accounts must be set upon account creation.
The DNS implementation must be configured such that it automatically recognizes and supports this activity and immediately enforces the current account policy. |
