| As most accounts in the domain name system are privileged or system level accounts, account management and distribution is vital to the security of the DNS implementation and infrastructure. If an attacker compromises an account, the entire DNS infrastructure, not to mention the hosts on the network, is at risk. Authentication for user or administrative access to the system is required at all times.
Emergency accounts are established in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes.
Emergency accounts are not to be confused with infrequently used accounts (e.g., local login accounts used for special tasks defined by organizations or when network resources are unavailable). Such accounts remain available and are not subject to automatic termination dates.
If accounts intended to be for emergency use remain active when no longer needed, they may be used to gain unauthorized access with privileged level access. To reduce this risk, automated termination of all emergency accounts must be set upon account creation.
The DNS implementation must be configured such that it automatically recognizes and supports this activity and immediately enforces the current account policy. |
