The DNS implementation must enforce approved authorizations for logical access to the system in accordance with applicable policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-33854	SRG-NET-000015-DNS-000015	SV-44307r1_rule		Medium

Description
Strong access controls are critical to securing DNS data and the DNS infrastructure. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed in multiple components of the DNS implementation, to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the DNS system. Without stringent logical access and authorization controls to configuration files, dynamic update functionality, zone transfers, zone data, etc., an adversary may have the ability, with very little effort, to compromise the DNS and associated supporting infrastructure.

Description

Strong access controls are critical to securing DNS data and the DNS infrastructure. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed in multiple components of the DNS implementation, to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the DNS system. Without stringent logical access and authorization controls to configuration files, dynamic update functionality, zone transfers, zone data, etc., an adversary may have the ability, with very little effort, to compromise the DNS and associated supporting infrastructure.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-41910r1_chk )
Review the DNS configuration to determine if logical access controls are in place to secure zone transfers, dynamic updates, configuration files, and zone data. If logical access controls are not in place, this is a finding.

Fix Text (F-37784r1_fix)
Configure logical access controls to secure the zone transfer and dynamic update function, configuration files, and zone data.