The DNS must implement a system isolation boundary to minimize the number of non-security functions included within the boundary containing security functions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-34137	SRG-NET-000187-DNS-000114	SV-44590r1_rule		Medium

Description
Security functions are defined as "the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based". If the security functions were to be undermined, the DNS implementation could be compromised. DNS implementers can increase the assurance in security functions by employing well-defined security policy models, structured, disciplined, and rigorous hardware and software development techniques, and sound system/security engineering principles. The DNS element must isolate security functions from non-security functions by means of an isolation boundary (implemented via partitions and domains) controlling access to and protecting the integrity of, the hardware, software, and firmware performing those security functions. The DNS element must maintain a separate execution domain (e.g., address space) for each executing process.

Description

Security functions are defined as "the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based". If the security functions were to be undermined, the DNS implementation could be compromised. DNS implementers can increase the assurance in security functions by employing well-defined security policy models, structured, disciplined, and rigorous hardware and software development techniques, and sound system/security engineering principles. The DNS element must isolate security functions from non-security functions by means of an isolation boundary (implemented via partitions and domains) controlling access to and protecting the integrity of, the hardware, software, and firmware performing those security functions. The DNS element must maintain a separate execution domain (e.g., address space) for each executing process.

STIG	Date
Domain Name System (DNS) Security Requirements Guide	2012-10-24

Details

Check Text ( C-42097r1_chk )
Review the DNS vendor documentation and configuration settings to determine if system isolation boundary exists to minimize the number of non-security functions included within the boundary containing security functions. If security functions are not isolated, this is a finding.

Fix Text (F-38047r1_fix)
Ensure the DNS implementation is designed such that a system isolation boundary exists to minimize the number of non-security functions included within the boundary containing security functions.