Check: WDNS-SC-000025
Microsoft Windows 2012 Server Domain Name System STIG:
WDNS-SC-000025
(in versions v2 r6 through v2 r1)
Title
The Windows 2012 DNS Server must not contain zone records that have not been validated in over a year. (Cat I impact)
Discussion
If zone information has not been validated in over a year, then there is no assurance that it is still valid. If invalid records are in a zone, then an adversary could potentially use their existence for improper purposes. An SOP detailing this process can resolve this requirement.
Check Content
This requirement is not applicable for a Windows DNS Server which is only hosting AD-integrated zones. For a Windows DNS Server which hosts a mix of AD-integrated zones and manually maintained zones, ask the DNS database administrator if they maintain a separate database with record documentation for the non-AD-integrated zone information. The reviewer should check that the record's last verified date is less than one year prior to the date of the review. If a separate database with record documentation is not maintained for the non-AD-integrated zone information, this is a finding. If a separate database with record documentation is maintained for the non-AD-integrated zone information, Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. From the expanded list, click to select the zone. Review the zone records of the non-AD-integrated zones and compare to the separate documentation maintained. Determine if any records have not been validated in over a year. If zone records exist which have not been validated in over a year, this is a finding.
Fix Text
Create a separate database to maintain record documentation for non-AD-integrated zones. Develop a procedure to validate annually all zone information on the DNS server against the separately maintained database. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. From the expanded list, click to select the zone. Select the zone records which have not been validated in over a year and revalidate.
Additional Identifiers
Rule ID: SV-215631r953852_rule
Vulnerability ID: V-215631
Group Title: SRG-APP-000428-DNS-000061
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002475 |
The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components. |
Controls
Number | Title |
---|---|
SC-28 (1) |
Cryptographic Protection |