The DNS implementation must use multifactor authentication for network access to non-privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34091	SRG-NET-000140-DNS-000081	SV-44544r1_rule		Medium

Description
Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As users have access to many of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user, to include potential escalation of privileges. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). Assuming that the DNS server is an appliance or a dedicated system, there should be no non privileged accounts.

Description

Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As users have access to many of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user, to include potential escalation of privileges. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). Assuming that the DNS server is an appliance or a dedicated system, there should be no non privileged accounts.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42050r1_chk )
Review the DNS implementation's authentication methods and settings to determine if multifactor authentication is utilized to gain network access to any of the non-privileged level accounts. If multifactor authentication is not utilized, this is a finding. The account management functions will be performed by the name server application if the capability exists. If the capability does not exist the underlying platform's account management system may be used.

Check Text ( C-42050r1_chk )

Review the DNS implementation's authentication methods and settings to determine if multifactor authentication is utilized to gain network access to any of the non-privileged level accounts. If multifactor authentication is not utilized, this is a finding.

The account management functions will be performed by the name server application if the capability exists. If the capability does not exist the underlying platform's account management system may be used.

Fix Text (F-38001r1_fix)
Configure the DNS implementation to utilize multifactor authentication for network access to non-privileged accounts.