STIGQter: STIG Summary: Infoblox 7.x DNS Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

An Infoblox DNS server must strongly bind the identity of the DNS server with the DNS information using DNSSEC.

DISA Rule

SV-214181r612370_rule

Vulnerability Number

V-214181

Group Title

SRG-APP-000347-DNS-000041

Rule Version

IDNS-7X-000390

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-001901 - The information system binds the identity of the information producer with the information to an organization-defined strength of binding.

Weight

10

Fix Recommendation

DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties, toggle Advanced Mode click on "DNSSEC" tab.

Enable both "Enable DNSSEC" and "Enable DNSSEC validation".
When complete, click "Save & Close" to save the changes and exit the "Properties" screen.

Perform a service restart if necessary.

Check Contents

Note: For Infoblox DNS systems on a Classified network, this requirement is Not Applicable.

Validate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties, toggle Advanced Mode click on "DNSSEC" tab.

Note: DNSSEC validation is only applicable on a grid member where recursion is active.

When complete, click "Cancel" to exit the "Properties" screen.

If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Vulnerability Number

V-214181

Documentable

False

Rule Version

IDNS-7X-000390

Severity Override Guidance

Note: For Infoblox DNS systems on a Classified network, this requirement is Not Applicable.

Validate that DNSSEC validation is enabled by navigating to Data Management >> DNS >> Grid DNS properties, toggle Advanced Mode click on "DNSSEC" tab.

Note: DNSSEC validation is only applicable on a grid member where recursion is active.

When complete, click "Cancel" to exit the "Properties" screen.

If both "Enable DNSSEC" and "Enable DNSSEC validation" are not enabled, this is a finding.

Check Content Reference

M

Target Key

3995

Comments