The DNS implementation must protect audit information from unauthorized deletion.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34041	SRG-NET-000100-DNS-000057	SV-44494r1_rule		Medium

Description
Protection of audit records and audit data is of critical importance. Care must be taken to ensure users cannot circumvent audit protections put in place and intentionally or inadvertently delete the data. If audit data were to be deleted, competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult if not impossible to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the integrity of audit data, the DNS implementation must protect audit information from any and all unauthorized deletions.

Description

Protection of audit records and audit data is of critical importance. Care must be taken to ensure users cannot circumvent audit protections put in place and intentionally or inadvertently delete the data. If audit data were to be deleted, competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult if not impossible to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. To ensure the integrity of audit data, the DNS implementation must protect audit information from any and all unauthorized deletions.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42009r1_chk )
Review the DNS systems audit log permissions and access controls to determine if sufficient restrictions are configured to protect audit logs against unauthorized deletions. If appropriate controls and permissions do not exist, this is a finding.

Fix Text (F-37957r1_fix)
Configure the DNS system to protect the DNS audit log data against unauthorized deletions.