The DNS implementation must use multifactor authentication for local access to non-privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34093	SRG-NET-000142-DNS-000083	SV-44546r1_rule		Medium

Description
Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As users have access to many of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user, to include potential escalation of privileges. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric).

Description

Single factor authentication poses much unnecessary risk upon any information system as most single factor authentication methods use only a userid and password. Passwords are, in most cases, easily hacked with the right tools. Multifactor authentication utilizes multiple levels of identification and authorization criteria and provides a much stronger level of security than single factor. As users have access to many of the files on the platform, using a single factor authentication approach provides an easy avenue of attack for a malicious user, to include potential escalation of privileges. Multifactor authentication includes: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric).

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42052r1_chk )
Review the DNS system authentication methods and settings to determine if multifactor authentication is utilized to gain local access to any of the non-privileged level accounts. If multifactor authentication is not utilized, this is a finding.

Fix Text (F-38003r1_fix)
Configure the DNS system to utilize multifactor authentication for local access to non-privileged accounts. The account management functions will be performed by the DNS application if the capability exists. If the capability does not exist the underlying platform's account management system may be used.