Navigate

CCI-002462

CCI-002462 Definition

Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if: - additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries. - integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries.

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; procedures addressing secure name/address resolution services (authoritative source); system design documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing DNS]. Test: [SELECT FROM: Mechanisms supporting and/or implementing secure name/address resolution services].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002462.

Control	Description
SC-20	a: Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and b: Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

Control

Description

SC-20

a: Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

b: Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.