+APP.2.2.A10 Secure Use of DNS for Active Directory (S)

APP.2.2.A10 Secure Use of DNS for Active Directory (S)

Integrated DNS zones or the secure dynamic updating of DNS data SHOULD be used. Access to the configuration data of the DNS server SHOULD only be permitted from administrative accounts. The DNS cache on DNS servers SHOULD be protected against unauthorised changes. Access to the DNS service of the domain controllers SHOULD be restricted to the necessary minimum. Network activities related to DNS requests SHOULD be monitored. Access to the DNS data in Active Directory SHOULD be restricted to administrators using ACLs.

Secondary DNS zones SHOULD be avoided. At minimum, the zone file SHOULD be protected against unauthorised access.

If IPsec is being used to protect DNS communications, sufficient data throughput SHOULD be ensured within the network.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin

Saincheisteanna nasctha

Naisc
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.40 Denial of Service
blocks G 0.42 Social Engineering
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information