Navigate

SC-21

SC-21: Secure Name / Address Resolution Service (Recursive Or Caching Resolver)

The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.

Supplemental

Each client of name resolution services either performs this validation on its own, or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching domain name system (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations. Information systems that use technologies other than the DNS to map between host/service names and network addresses provide other means to enable clients to verify the authenticity and integrity of response data.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-21.

Control	Description
SC-20	The information system: SC-20a.: Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and SC-20b.: Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
SC-22	The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.

Control

Description

SC-20

The information system:

SC-20a.: Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

SC-20b.: Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

SC-22

The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.

Enhancements

The controls below (if any) add on to the requirements of SC-21.

Control	Description
SC-21 (1)	[Withdrawn: Incorporated into SC-21].

Related CCIs

The CCIs below are tied to SC-21.

CCI	Definition
CCI-002465	The information system requests data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.
CCI-002466	The information system requests data integrity verification on the name/address resolution responses the system receives from authoritative sources.
CCI-002467	The information system performs data integrity verification on the name/address resolution responses the system receives from authoritative sources.
CCI-002468	The information system performs data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.