The DNS system must protect non-local maintenance sessions through the use of multifactor authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34125	SRG-NET-000174-DNS-000110	SV-44578r1_rule		Medium

Description
Lack of authentication enables anyone to gain access to the network or possibly a network element that provides opportunity for intruders to compromise resources within the network infrastructure. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Authorization for access to any network element requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of all administrator accounts for all privilege levels must be accomplished using two or more factors that include the following: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). All maintenance sessions to a DNS system must require the use of multifactor authentication regardless of whether the session is local or non-local.

Description

Lack of authentication enables anyone to gain access to the network or possibly a network element that provides opportunity for intruders to compromise resources within the network infrastructure. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Authorization for access to any network element requires an individual account identifier that has been approved, assigned, and configured on an authentication server. Authentication of all administrator accounts for all privilege levels must be accomplished using two or more factors that include the following: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). All maintenance sessions to a DNS system must require the use of multifactor authentication regardless of whether the session is local or non-local.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42085r1_chk )
Review the DNS implementation's authentication methods and settings to determine if multifactor authentication is utilized to gain non-local access to any accounts used for maintenance and diagnostics. If multifactor authentication is not utilized, this is a finding.

Fix Text (F-38035r1_fix)
Configure the DNS system to utilize multifactor authentication for non-local access to accounts for maintenance and diagnostics.