DISA_STIG_Windows_2012_Server_DNS_v1r14.audit from DISA Microsoft Windows 2012 Server Domain Name System v1r14 STIG

WDNS-AC-000001 - The Windows 2012 DNS Server must restrict incoming dynamic update requests to known clients.

800-53|SC-7(11)

CAT|II

CCI|CCI-000054

Rule-ID|SV-72667r3_rule

STIG-ID|WDNS-AC-000001

Vuln-ID|V-58237

WDNS-AU-000001 - The Windows 2012 DNS Server must be configured to record, and make available to authorized personnel, who added/modified/deleted DNS zone information.

800-53|AU-12

CCI|CCI-000366

CCI|CCI-001902

Rule-ID|SV-72973r3_rule

STIG-ID|WDNS-AU-000001

Vuln-ID|V-58543

WDNS-AU-000003 - The Windows 2012 DNS Server must, in the event of an error validating another DNS servers identity, send notification to the DNS administrator.

CCI|CCI-001906

Rule-ID|SV-72977r4_rule

STIG-ID|WDNS-AU-000003

Vuln-ID|V-58547

WDNS-AU-000005 - The Windows 2012 DNS Server log must be enabled.

CCI|CCI-000169

Rule-ID|SV-72979r3_rule

STIG-ID|WDNS-AU-000005

Vuln-ID|V-58549

WDNS-AU-000006 - The Windows 2012 DNS Server logging must be enabled to record events from all DNS server functions.

Rule-ID|SV-72981r6_rule

STIG-ID|WDNS-AU-000006

Vuln-ID|V-58551

WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM - manage

800-53|AC-6(7)

CCI|CCI-000171

CSCv6|5.1

Rule-ID|SV-72983r5_rule

STIG-ID|WDNS-AU-000007

Vuln-ID|V-58553

WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM - permissions

WDNS-AU-000008 - The Windows 2012 DNS Server must generate audit records for the success and failure of all name server events - enabled

CCI|CCI-000172

Rule-ID|SV-72985r5_rule

STIG-ID|WDNS-AU-000008

Vuln-ID|V-58555

WDNS-AU-000008 - The Windows 2012 DNS Server must generate audit records for the success and failure of all name server events - enhanced

WDNS-AU-000010 - The Windows 2012 DNS Server log must include event types within the log records - enabled

CCI|CCI-000130

Rule-ID|SV-72991r3_rule

STIG-ID|WDNS-AU-000010

Vuln-ID|V-58561

WDNS-AU-000010 - The Windows 2012 DNS Server log must include event types within the log records - enhanced

WDNS-AU-000011 - The Windows 2012 DNS Server log must include time stamps within the log records - enabled

CCI|CCI-000131

Rule-ID|SV-72993r3_rule

STIG-ID|WDNS-AU-000011

Vuln-ID|V-58563

WDNS-AU-000011 - The Windows 2012 DNS Server log must include time stamps within the log records - enhanced

WDNS-AU-000012 - The Windows 2012 DNS Server log must include origin of events within the log records - enabled

CCI|CCI-000132

Rule-ID|SV-72995r3_rule

STIG-ID|WDNS-AU-000012

Vuln-ID|V-58565

WDNS-AU-000012 - The Windows 2012 DNS Server log must include origin of events within the log records - enhanced

WDNS-AU-000013 - The Windows 2012 DNS Server log must include the source of events within the log records - enabled

CCI|CCI-000133

Rule-ID|SV-72997r3_rule

STIG-ID|WDNS-AU-000013

Vuln-ID|V-58567

WDNS-AU-000013 - The Windows 2012 DNS Server log must include the source of events within the log records - enhanced

WDNS-AU-000014 - The Windows 2012 DNS Server log must include results of events within the log records - enabled

CCI|CCI-000134

Rule-ID|SV-72999r3_rule

STIG-ID|WDNS-AU-000014

Vuln-ID|V-58569

WDNS-AU-000014 - The Windows 2012 DNS Server log must include results of events within the log records - enhanced

WDNS-AU-000015 - The Windows 2012 DNS Server log must include identity of individual or process associated with events within the log records - enabled

CCI|CCI-001487

Rule-ID|SV-73001r3_rule

STIG-ID|WDNS-AU-000015

Vuln-ID|V-58571

WDNS-AU-000015 - The Windows 2012 DNS Server log must include identity of individual or process associated with events within the log records - enhanced

WDNS-AU-000016 - The Windows 2012 DNS Servers audit records must be backed up at least every seven days onto a different system or system component than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-73003r4_rule

STIG-ID|WDNS-AU-000016

Vuln-ID|V-58573

WDNS-CM-000001 - The validity period for the RRSIGs covering the DS RR for a zones delegated children must be no less than two days and no more than one week.

800-53|CM-6

Rule-ID|SV-73005r4_rule

STIG-ID|WDNS-CM-000001

Vuln-ID|V-58575

WDNS-CM-000002 - The Windows DNS name servers for a zone must be geographically dispersed.

Rule-ID|SV-73007r4_rule

STIG-ID|WDNS-CM-000002

Vuln-ID|V-58577

WDNS-CM-000003 - The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries - recursion

800-53|SC-22

Rule-ID|SV-73009r5_rule

STIG-ID|WDNS-CM-000003

Vuln-ID|V-58579

WDNS-CM-000003 - The Windows 2012 DNS Server must prohibit recursion on authoritative name servers for which forwarders have not been configured for external queries - root hints

WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS) - forwarders

Rule-ID|SV-73011r5_rule

STIG-ID|WDNS-CM-000004

Vuln-ID|V-58581

WDNS-CM-000004 - Forwarders on an authoritative Windows 2012 DNS Server, if enabled for external resolution, must only forward to either an internal, non-AD-integrated DNS server or to the DoD Enterprise Recursive Services (ERS) - root hints

WDNS-CM-000005 - The Windows 2012 DNS Server with a caching name server role must restrict recursive query responses to only the IP addresses and IP address ranges of known supported clients.

800-53|SC-21

Rule-ID|SV-73013r5_rule

STIG-ID|WDNS-CM-000005

Vuln-ID|V-58583

WDNS-CM-000006 - The Windows 2012 DNS Server with a caching name server role must be secured against pollution by ensuring the authenticity and integrity of queried records.

Rule-ID|SV-73015r4_rule

STIG-ID|WDNS-CM-000006

Vuln-ID|V-58585

WDNS-CM-000007 - The Windows 2012 DNS Server must implement cryptographic mechanisms to detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).

800-53|SC-8

Rule-ID|SV-73017r6_rule

STIG-ID|WDNS-CM-000007

Vuln-ID|V-58587

WDNS-CM-000008 - The validity period for the RRSIGs covering a zones DNSKEY RRSet must be no less than two days and no more than one week.

Rule-ID|SV-73019r5_rule

STIG-ID|WDNS-CM-000008

Vuln-ID|V-58589

WDNS-CM-000009 - NSEC3 must be used for all internal DNS zones.

Rule-ID|SV-73021r4_rule

STIG-ID|WDNS-CM-000009

Vuln-ID|V-58591

WDNS-CM-000010 - The Windows 2012 DNS Servers zone files must have NS records that point to active name servers authoritative for the domain specified in that record.

CAT|I

Rule-ID|SV-73023r5_rule

STIG-ID|WDNS-CM-000010

Vuln-ID|V-58593

WDNS-CM-000012 - All authoritative name servers for a zone must be located on different network segments.

Rule-ID|SV-73025r4_rule

STIG-ID|WDNS-CM-000012

Vuln-ID|V-58595

WDNS-CM-000013 - All authoritative name servers for a zone must have the same version of zone information.

Rule-ID|SV-73027r3_rule

STIG-ID|WDNS-CM-000013

Vuln-ID|V-58597

WDNS-CM-000014 - The Windows 2012 DNS Server must be configured to enable DNSSEC Resource Records.

Rule-ID|SV-73029r5_rule

STIG-ID|WDNS-CM-000014

Vuln-ID|V-58599

WDNS-CM-000015 - Digital signature algorithm used for DNSSEC-enabled zones must be FIPS-compatible.

Rule-ID|SV-73031r4_rule

STIG-ID|WDNS-CM-000015

Vuln-ID|V-58601

WDNS-CM-000016 - For zones split between the external and internal sides of a network, the RRs for the external hosts must be separate from the RRs for the internal hosts.

Rule-ID|SV-73033r3_rule

STIG-ID|WDNS-CM-000016

Vuln-ID|V-58603

WDNS-CM-000017 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the external name server must be configured to not be reachable from inside resolvers.

Rule-ID|SV-73035r4_rule

STIG-ID|WDNS-CM-000017

Vuln-ID|V-58605

WDNS-CM-000018 - In a split DNS configuration, where separate name servers are used between the external and internal networks, the internal name server must be configured to not be reachable from outside resolvers.

Rule-ID|SV-73037r4_rule

STIG-ID|WDNS-CM-000018

Vuln-ID|V-58607

WDNS-CM-000019 - Primary authoritative name servers must be configured to only receive zone transfer requests from specified secondary name servers.

800-53|SC-20

Rule-ID|SV-73039r3_rule

STIG-ID|WDNS-CM-000019

Vuln-ID|V-58609

WDNS-CM-000020 - The Windows 2012 DNS Servers zone database files must not be accessible for edit/write by users and/or processes other than the Windows 2012 DNS Server service account and/or the DNS database administrator.

800-53|AC-6

Rule-ID|SV-73041r4_rule

STIG-ID|WDNS-CM-000020

Vuln-ID|V-58611

WDNS-CM-000021 - The Windows 2012 DNS Server must implement internal/external role separation.

Rule-ID|SV-73043r3_rule

STIG-ID|WDNS-CM-000021

Vuln-ID|V-58613

WDNS-CM-000022 - The Windows 2012 DNS Server authoritative for local zones must only point root hints to the DNS servers that host the internal root domain.

Rule-ID|SV-73045r5_rule

STIG-ID|WDNS-CM-000022

Vuln-ID|V-58615

WDNS-CM-000023 - The DNS name server software must be at the latest version.

Rule-ID|SV-73047r4_rule

STIG-ID|WDNS-CM-000023

Vuln-ID|V-58617

WDNS-CM-000024 - The Windows 2012 DNS Servers zone files must not include resource records that resolve to a fully qualified domain name residing in another zone.

Rule-ID|SV-73049r3_rule

STIG-ID|WDNS-CM-000024

Vuln-ID|V-58619

WDNS-CM-000025 - The Windows 2012 DNS Servers zone files must not include CNAME records pointing to a zone with lesser security for more than six months.

Rule-ID|SV-73051r4_rule

STIG-ID|WDNS-CM-000025

Vuln-ID|V-58621

WDNS-CM-000026 - Non-routable IPv6 link-local scope addresses must not be configured in any zone.

Rule-ID|SV-73053r3_rule

STIG-ID|WDNS-CM-000026

Vuln-ID|V-58623

WDNS-CM-000027 - AAAA addresses must not be configured in a zone for hosts that are not IPv6-aware.

Rule-ID|SV-73055r3_rule

STIG-ID|WDNS-CM-000027

Vuln-ID|V-58625

WDNS-CM-000028 - IPv6 protocol must be disabled unless the Windows 2012 DNS server is configured to answer for and hosting IPv6 AAAA records.

Detections

Analytics

DISA Microsoft Windows 2012 Server DNS STIG v1r14

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Jan 28, 2021 Miscellaneous Audit deprecated. Metadata updated.
Revision 1.1 Sep 29, 2020 Miscellaneous References updated.