Domain Name System (DNS) Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The DNS implementation must enforce a Discretionary Access Control (DAC) policy that limits propagation of access rights.
Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in whic...Rule Medium Severity -
The platform on which the name server software is hosted must be configured to respond to DNS traffic only.
OS configuration practices as issued by the US Computer Emergency Response Team (US CERT) and the National Institute of Standards and Technology's (NIST's) National Vulnerability Database (NVD), ba...Rule Medium Severity -
The platform on which the name server software is hosted must be configured to send outgoing DNS messages from a random port.
OS configuration practices as issued by the US Computer Emergency Response Team (US CERT) and the National Institute of Standards and Technology's (NIST's) National Vulnerability Database (NVD), ba...Rule Medium Severity -
The private keys corresponding to both the ZSK and the KSK must not be kept on the DNSSEC-aware primary authoritative name server when the name server does not support dynamic updates.
The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored off-line (with respect to the Internet-facing, DNSSEC-aware ...Rule Medium Severity -
A zone file must not include resource records that resolve to a fully qualified domain name residing in another zone.
If a name server were able to claim authority for a resource record in a domain for which it was not authoritative, this would pose a security risk. In this environment, an adversary could use illi...Rule Medium Severity -
The DNS server implementation must alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.
Audit information includes all information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personally identifiable information. Audit log...Rule Medium Severity -
The DNS server implementation must implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access.
The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multifactor authentication is to reduce the likelihoo...Rule Medium Severity -
The DNS server implementation must implement multifactor authentication for local; network; and/or remote access to privileged accounts; and/or nonprivileged accounts such that the device meets organization-defined strength of mechanism requirements.
The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multifactor authentication is to reduce the likelihoo...Rule Medium Severity -
The DNS server implementation must, for password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter pass...Rule Medium Severity -
The DNS server implementation must, for password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter pass...Rule Medium Severity -
The DNS server implementation must, for password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter pass...Rule Medium Severity -
The DNS server implementation must, for password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.
Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter pass...Rule Medium Severity -
The DNS server implementation must synchronize system clocks within and between systems or system components.
Time synchronization of system clocks is essential for the correct execution of many system services, including identification and authentication processes that involve certificates and time-of-day...Rule Medium Severity -
SRG-APP-000394
Group -
SRG-APP-000001
Group -
SRG-APP-000001
Group -
The DNS implementation must limit the number of concurrent sessions client connections to the number of allowed dynamic update clients.
Limiting the number of concurrent sessions reduces the risk of Denial of Service (DoS) to the DNS implementation. Name servers do not have direct user connections but accept client connections fo...Rule Medium Severity -
SRG-APP-000089
Group -
The DNS server implementation must be configured to provide audit record generation capability for DoD-defined auditable events within all DNS server components.
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actua...Rule Medium Severity -
SRG-APP-000089
Group -
The DNS server implementation must be configured to provide audit record generation capability for DoD-defined auditable events within all DNS server components.
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actua...Rule Medium Severity -
SRG-APP-000095
Group -
SRG-APP-000096
Group -
SRG-APP-000097
Group -
The DNS server implementation must produce audit records containing information to establish where the events occurred.
Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events relating to an incident. Associating information about where the event occurred with...Rule Medium Severity -
SRG-APP-000098
Group -
The DNS server implementation must produce audit records containing information to establish the source of the events.
Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. Associating information about the source of the...Rule Medium Severity -
SRG-APP-000099
Group -
The DNS server implementation must produce audit records that contain information to establish the outcome of the events.
Without information about the outcome of events, security personnel cannot make an accurate assessment about whether an attack was successful or if changes were made to the security state of the sy...Rule Medium Severity -
SRG-APP-000100
Group -
The DNS server implementation must generate audit records containing information that establishes the identity of any individual or process associated with the event.
Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility...Rule Medium Severity -
SRG-APP-000125
Group -
SRG-APP-000142
Group -
SRG-APP-000158
Group -
The DNS server implementation must uniquely identify the other DNS server before responding to a server-to-server transaction.
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. This applies to server-to-server (zone transfer) transactions only and is pr...Rule Medium Severity -
SRG-APP-000176
Group -
The DNS server implementation, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation...Rule Medium Severity -
SRG-APP-000176
Group -
The key file must be owned by the account under which the name server software is run.
To enable zone transfer (requests and responses) through authenticated messages, it is necessary to generate a key for every pair of name servers. The key can also be used for securing other transa...Rule Medium Severity -
SRG-APP-000176
Group -
SRG-APP-000176
Group -
Only the private key corresponding to the ZSK alone must be kept on the name server that does support dynamic updates.
The private keys in the KSK and ZSK key pairs must be protected from unauthorized access. If possible, the private keys should be stored off-line (with respect to the Internet-facing, DNSSEC-aware ...Rule Medium Severity -
SRG-APP-000176
Group -
SRG-APP-000185
Group -
The DNS server implementation must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
If maintenance tools are used by unauthorized personnel, they may accidentally or intentionally damage or compromise the system. The act of managing systems and applications includes the ability to...Rule Medium Severity -
SRG-APP-000213
Group -
SRG-APP-000214
Group -
A DNS server implementation must provide the means to indicate the security status of child zones.
If name server replies are invalid or cannot be validated, many networking functions and communication would be adversely affected. With DNS, the presence of Delegation Signer (DS) records associat...Rule Medium Severity -
SRG-APP-000214
Group -
The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.
The best way for a zone administrator to minimize the impact of a key compromise is by limiting the validity period of RRSIGs in the zone and in the parent zone. This strategy limits the time durin...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.