| Strong access controls are critical to securing DNS data and the DNS infrastructure. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed in multiple components of the DNS implementation, to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains) in the DNS system.
Without stringent logical access and authorization controls to configuration files, dynamic update functionality, zone transfers, zone data, etc., an adversary may have the ability, with very little effort, to compromise the DNS and associated supporting infrastructure. |
