800-53|SC-20

Title

SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE)

Description

The information system:

Supplemental

This control enables external clients including, for example, remote Internet clients, to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service. Information systems that provide name and address resolution services include, for example, domain name system (DNS) servers. Additional artifacts include, for example, DNS Security (DNSSEC) digital signatures and cryptographic keys. DNS resource records are examples of authoritative data. The means to indicate the security status of child zones includes, for example, the use of delegation signer resource records in the DNS. The DNS security controls reflect (and are referenced from) OMB Memorandum 08-23. Information systems that use technologies other than the DNS to map between host/service names and network addresses provide other means to assure the authenticity and integrity of response data.

Reference Item Details

Related: AU-10,SC-12,SC-13,SC-21,SC-22,SC-8

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Family: SYSTEM AND COMMUNICATIONS PROTECTION

Priority: P1

Baseline Impact: LOW,MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1 Ensure DNS server is configuredFortiGateCIS Fortigate 7.0.x v1.3.0 L1
1.5.7 Ensure DNS is servers are configured - nameserver 1UnixCIS Amazon Linux 2 STIG v1.0.0 L3
1.5.7 Ensure DNS is servers are configured - nameserver 2UnixCIS Amazon Linux 2 STIG v1.0.0 L3
2.1.5 Ensure hostname is setFortiGateCIS Fortigate 7.0.x v1.3.0 L1
2.1.6 Ensure DNS server is configured - primaryCheckPointCIS Check Point Firewall L1 v1.1.0
3.1 Ensure DNS services are configured correctly - name-serverCiscoCIS Cisco Firewall v8.x L1 v4.2.0
3.1.16 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'microsoft_azureCIS Microsoft Azure Foundations v3.0.0 L2
3.2 Restrict Recursive Queries - Authoritative Name ServerUnixCIS BIND DNS v3.0.1 Authoritative Name Server
3.4 Restrict Queries of the Cache - Authoritative OnlyUnixCIS BIND DNS v3.0.1 Authoritative Name Server
5.4 CIFS - 'dns.domainname has been configured'NetAppTNS NetApp Data ONTAP 7G
5.4 CIFS - 'dns.enable = on'NetAppTNS NetApp Data ONTAP 7G
5.4 CIFS - 'dns.update.enable = on or secure'NetAppTNS NetApp Data ONTAP 7G
5.7.4 The default namespace should not be usedOpenShiftCIS RedHat OpenShift Container Platform v1.6.0 L2
6.1 Ensure Root Domain Alias Record Points to ELBamazon_awsCIS Amazon Web Services Three-tier Web Architecture L2 1.0.0
6.2 Ensure a DNS alias record for the root domainamazon_awsCIS Amazon Web Services Three-tier Web Architecture L2 1.0.0
7.4 Ensure Either SPF or DKIM DNS Records are ConfiguredUnixCIS BIND DNS v1.0.0 L2 Authoritative Name Server
8.3 Ensure Any Signing Keys using RSA Have a Length of 2048 or GreaterUnixCIS BIND DNS v1.0.0 L2 Authoritative Name Server
Adtran : Ensure a trusted, primary DNS server is setAdtranTNS Adtran AOS Best Practice Audit
Adtran : Ensure a trusted, secondary DNS server is setAdtranTNS Adtran AOS Best Practice Audit
DNS Profile - Address - DNS Server 1Cisco_ACITenable Cisco ACI
DNS Profile - Address - DNS Server 2Cisco_ACITenable Cisco ACI
DNS: A trusted primary DNS server is configuredAlcatelTNS Alcatel-Lucent TiMOS/Nokia SR-OS Best Practice Audit
DNS: A trusted secondary DNS server is configuredAlcatelTNS Alcatel-Lucent TiMOS/Nokia SR-OS Best Practice Audit
Ensure DNS services are configured correctly - name-serverCiscoTenable Cisco Firepower Best Practices Audit
Ensure DNS services are configured correctly - name-serverCisco_FirepowerTenable Cisco Firepower Threat Defense Best Practices Audit
FireEye - The appliance uses a trusted DNS serverFireEyeTNS FireEye
Fortigate - DNS - primary serverFortiGateTNS Fortigate FortiOS Best Practices v2.0.0
Fortigate - DNS - secondary serverFortiGateTNS Fortigate FortiOS Best Practices v2.0.0
MS.AAD.3.1v1 - Phishing-resistant MFA SHALL be enforced for all users.microsoft_azureCISA SCuBA Microsoft 365 Entra ID v1.5.0
MS.AAD.3.5v1 - The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.microsoft_azureCISA SCuBA Microsoft 365 Entra ID v1.5.0
MS.AAD.3.6v1 - Phishing-resistant MFA SHALL be required for highly privileged roles.microsoft_azureCISA SCuBA Microsoft 365 Entra ID v1.5.0
MS.DEFENDER.1.1v1 - The standard and strict preset security policies SHALL be enabled.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.1.2v1 - All users SHALL be added to Exchange Online Protection (EOP) in either the standard or strict preset security policy.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.1.3v1 - All users SHALL be added to Defender for Office 365 protection in either the standard or strict preset security policy.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.1.4v1 - Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.1.5v1 - Sensitive accounts SHALL be added to Defender for Office 365 protection in the strict preset security policy.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.2.1v1 - User impersonation protection SHOULD be enabled for sensitive accounts in both the standard and strict preset policies.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.2.2v1 - Domain impersonation protection SHOULD be enabled for domains owned by the agency in both the standard and strict preset policies.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.2.3v1 - Domain impersonation protection SHOULD be added for important partners in both the standard and strict preset policies.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.DEFENDER.3.1v1 - Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams.microsoft_azureCISA SCuBA Microsoft 365 Defender v1.5.0
MS.EXO.1.1v1 - Automatic forwarding to external domains SHALL be disabled.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.10.1v1 - Emails SHALL be scanned for malware.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.10.2v1 - Emails identified as containing malware SHALL be quarantined or dropped.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.10.3v1 - Email scanning SHALL be capable of reviewing emails after delivery.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.11.1v1 - Impersonation protection checks SHOULD be used.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.11.2v1 - User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.11.3v1 - The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.14.1v2 - A spam filter SHALL be enabled.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.14.2v1 - Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0
MS.EXO.14.3v1 - Allowed domains SHALL NOT be added to inbound anti-spam protection policies.microsoft_azureCISA SCuBA Microsoft 365 Exchange Online v1.5.0